Page 473 - GDPR and US States General Privacy Laws Deskbook

473 | Recitals (EU General Data Protection Regulation)
In order to ensure fair and transparent processing in respect of the data subject, taking into account the specific
circumstances and context in which the personal data are processed, the controller should use appropriate mathematical
or statistical procedures for the profiling, implement technical and organisational measures appropriate to ensure, in
particular, that factors which result in inaccuracies in personal data are corrected and the risk of errors is minimised,
secure personal data in a manner that takes account of the potential risks involved for the interests and rights of the data
subject, and prevent, inter alia, discriminatory effects on natural persons on the basis of racial or ethnic origin, political
opinion, religion or beliefs, trade union membership, genetic or health status or sexual orientation, or processing that
results in measures having such an effect.
(72)  Profiling is subject to the rules of this Regulation governing the processing of personal data, such as the legal grounds for
processing or data protection principles. The European Data Protection Board established by this Regulation (the ‘Board’)
should be able to issue guidance in that context.
(73)  Restrictions concerning specific principles and the rights of information, access to and rectification or erasure of personal
data, the right to data portability, the right to object, decisions based on profiling, as well as the communication of a
personal data breach to a data subject and certain related obligations of the controllers may be imposed by Union or
Member State law, as far as necessary and proportionate in a democratic society to safeguard public security, including
the protection of human life especially in response to natural or manmade disasters, the prevention, investigation and
prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the
prevention of threats to public security, or of breaches of ethics for regulated professions, other important objectives of
general public interest of the Union or of a Member State, in particular an important economic or financial interest of the
Union or of a Member State, the keeping of public registers kept for reasons of general public interest, further processing
of archived personal data to provide specific information related to the political behaviour under former totalitarian state
regimes or the protection of the data subject or the rights and freedoms of others, including social protection, public
health and humanitarian purposes. Those restrictions should be in accordance with the requirements set out in the
Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.
(74)  The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the
controller’s behalf should be established. In particular, the controller should be obliged to implement appropriate and
effective measures and be able to demonstrate the compliance of processing activities with this Regulation, including the
effectiveness of the measures. Those measures should take into account the nature, scope, context and purposes of the
processing and the risk to the rights and freedoms of natural persons.
(75)  The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data
processing which could lead to physical, material or non-material damage, in particular: where the processing may give
rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal
data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic
or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising
control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions,
religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or
data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are
evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health,
personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal
profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing
involves a large amount of personal data and affects a large number of data subjects.
(76)  The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference
to the nature, scope, context and purposes of the processing. Risk should be evaluated on the basis of an objective
assessment, by which it is established whether data processing operations involve a risk or a high risk.