1 Personal data must be processed lawfully.
2 The processing must be carried out in good faith and be proportionate.
3 Personal data may only be collected for a specific purpose that the data subject can recognise; personal data may only be further processed in a manner that is compatible with this purpose.
4 They shall be destroyed or anonymised as soon as they are no longer required for the purpose of processing.
5 Any person who processes personal data must satisfy themselves that the data are accurate. They must take all appropriate measures to correct, delete or destroy data that are incorrect or incomplete insofar as the purpose for which they are collected or processed is concerned. The appropriateness of the measures depends in particular on the form and the extent of the processing and on the risk that the processing poses to the data subject's personality or fundamental rights.
6 If the consent of the data subject is required, such consent is only valid if given voluntarily for one or more specific instances of processing based on appropriate information.
7 The consent must be explicitly given for:
- a.
processing sensitive personal data;
- b.
high-risk profiling by a private person; or
- c.
profiling by a federal body.