eu-charter

Carta de los Derechos Fundamentales de la Unión Europea

Artículo 8 - Protección de datos de carácter personal

Artículo 8 - Protección de datos de carácter personal

1. Toda persona tiene derecho a la protección de los datos de carácter personal que le conciernan.

2. Estos datos se tratarán de modo leal, para fines concretos y sobre la base del consentimiento de la persona afectada o en virtud de otro fundamento legítimo previsto por la ley. Toda persona tiene derecho a acceder a los datos recogidos que le conciernan y a obtener su rectificación.

3. El respeto de estas normas estará sujeto al control de una autoridad independiente.

    • Text:
      Source:
      Preamble - Explanations relating to the Charter of Fundamental Rights:
    • Deldits
      Decision date:
      Deciding body type:
      Court of Justice of the European Union
      Deciding body:
      Type:
      Decision
      Policy area:
      ECLI (European case law identifier):
      ECLI:EU:C:2025:172
    • VP v Országos Idegenrendészeti Főigazgatóság
      Decision date:
      Deciding body type:
      Court of Justice of the European Union
      Deciding body:
      Type:
      Decision
      Policy area:
      ECLI (European case law identifier):
      ECLI:EU:C:2025:172
    • Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect
      Decision date:
      Deciding body type:
      Court of Justice of the European Union
      Deciding body:
      Type:
      Decision
      Policy area:
      ECLI (European case law identifier):
      ECLI:EU:C:2025:2
    • Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect
      Decision date:
      Deciding body type:
      Court of Justice of the European Union
      Deciding body:
      Type:
      Decision
      Policy area:
      ECLI (European case law identifier):
      ECLI:EU:C:2025:2
    • C.G. v Bezirkshauptmannschaft Landeck
      Decision date:
      Deciding body type:
      Court of Justice of the European Union
      Deciding body:
      Type:
      Decision
      Policy area:
      ECLI (European case law identifier):
      ECLI:EU:C:2024:830
    • TR v Land Hessen
      Decision date:
      Deciding body type:
      Court of Justice of the European Union
      Deciding body:
      Court (First Chamber)
      Type:
      Decision
      Policy area:
      ECLI (European case law identifier):
      ECLI:EU:C:2024:785
    • Social media platform service user v Social media platform service provider
      Decision date:
      Deciding body type:
      National Court/Tribunal
      Deciding body:
      Type:
      Policy area:
      ECLI (European case law identifier):
    • La Quadrature du Net, Fédération des fournisseurs d’accès à Internet associatifs, Franciliens.net, French Data Network v Premier ministre, Ministre de la Culture
      Decision date:
      Deciding body type:
      Court of Justice of the European Union
      Deciding body:
      Court (Full Court)
      Type:
      Decision
      Policy area:
      Justice, freedom and security
      ECLI (European case law identifier):
      ECLI:EU:C:2024:370
    • Criminal proceedings against Procura della Repubblica presso il Tribunale di Bolzano.
      Decision date:
      Deciding body type:
      Court of Justice of the European Union
      Deciding body:
      Court (Grand Chamber)
      Type:
      Policy area:
      Justice, freedom and security
      ECLI (European case law identifier):
      ECLI:EU:C:2024:371
    • Anonymous v. Hellenic Authority for Communication Security and Privacy
      Decision date:
      Deciding body type:
      National Court/Tribunal
      Deciding body:
      Type:
      Decision
      Policy area:
      ECLI (European case law identifier):

    2 results found

    • The Processing of Personal Data (Protection of the Individual) Law
      País:
      Cyprus

      Scope of the law 3.(1) The provisions of this Law shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.(…)

    • Νόμοι 138(Ι) του 2001 και 37(Ι) του 2003
      País:
      Cyprus

      Πεδίο εφαρμογής.3.-(1) Οι διατάξεις του παρόντος Νόμου εφαρμόζονται στην αυτοματοποιημένη εν όλω ή εν μέρει επεξεργασία, καθώς και στη μη αυτοματοποιημένη επεξεργασία δεδομένων προσωπικού χαρακτήρα, τα οποία περιλαμβάνονται (...).

    37 results found

    • Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’)

      Preamble

      (30) The investigations of the EPPO should as a rule be carried out by European Delegated Prosecutors in the Member States. They should do so in accordance with this Regulation and, as regards matters not covered by this Regulation, in accordance with national law. European Delegated Prosecutors should carry out their tasks under the supervision of the supervising European Prosecutor and under the direction and instruction of the competent Permanent Chamber. Where the national law of a Member State provides for the internal review of certain acts within the structure of the national prosecutor’s office, the review of such decisions taken by the European Delegated Prosecutor should fall under the supervision powers of the supervising European Prosecutor in accordance with the internal rules of procedure of the EPPO. In such cases, Member States should not be obliged to provide for review by national courts, without prejudice to Article 19 TEU and Article 47 of the Charter of Fundamental Rights of the European Union (‘the Charter’).


      (80) The evidence presented by the EPPO in court should not be denied admission on the mere ground that the evidence was gathered in another Member State or in accordance with the law of another Member State, provided that the trial court considers its admission to respect the fairness of the procedure and the suspect or accused person’s rights of defence under the Charter. This Regulation respects the fundamental rights and observes the principles recognised by Article 6 TEU and in the Charter, in particular Title VI thereof, by international law and by international agreements to which the Union or all the Member States are party, including the European Convention for the Protection of Human Rights and Fundamental Freedoms, and by Member States’ constitutions in their respective fields of application. In line with those principles, and in respecting the different legal systems and traditions of the Member States as provided for in Article 67(1) TFEU, nothing in this Regulation may be interpreted as prohibiting the courts from applying the fundamental principles of national law on fairness of the procedure that they apply in their national systems, including in common law systems.


      (83) This Regulation requires the EPPO to respect, in particular, the right to a fair trial, the rights of the defence and the presumption of innocence, as enshrined in Articles 47 and 48 of the Charter. Article 50 of the Charter, which protects the right not to be tried or punished twice in criminal proceedings for the same offence (ne bis in idem), ensures that there will be no double jeopardy as a result of the prosecutions brought by the EPPO. The activities of the EPPO should thus be exercised in full compliance with those rights and this Regulation should be applied and interpreted accordingly.

      (98) In order to ensure effective, reliable and consistent monitoring of compliance with and enforcement of this Regulation as regards operational personal data, as required by Article 8 of the Charter, the European Data Protection Supervisor should have the tasks laid down in this Regulation and should have effective powers, including investigative, corrective, and advisory powers which constitute the necessary means to perform those tasks. However, the powers of the European Data Protection Supervisor should not unduly interfere with specific rules for criminal proceedings, including investigation and prosecution of criminal offences, or the independence of the judiciary.

      Article 5: Basic principles of the activities

      1.   The EPPO shall ensure that its activities respect the rights enshrined in the Charter.

      2.   The EPPO shall be bound by the principles of rule of law and proportionality in all its activities.

      3.   The investigations and prosecutions on behalf of the EPPO shall be governed by this Regulation. National law shall apply to the extent that a matter is not regulated by this Regulation. Unless otherwise specified in this Regulation, the applicable national law shall be the law of the Member State whose European Delegated Prosecutor is handling the case in accordance with Article 13(1). Where a matter is governed by both national law and this Regulation, the latter shall prevail.

      4.   The EPPO shall conduct its investigations in an impartial manner and shall seek all relevant evidence whether inculpatory or exculpatory.

      5.   The EPPO shall open and conduct investigations without undue delay.

      6.   The competent national authorities shall actively assist and support the investigations and prosecutions of the EPPO. Any action, policy or procedure under this Regulation shall be guided by the principle of sincere cooperation.

      Article 41: Scope of the rights of the suspects and accused persons

      1.   The activities of the EPPO shall be carried out in full compliance with the rights of suspects and accused persons enshrined in the Charter, including the right to a fair trial and the rights of defence.

      2.   Any suspected or accused person in the criminal proceedings of the EPPO shall, at aa minimum, have the procedural rights provided for in Union law, including directives concerning the rights of suspects and accused persons in criminal procedures, as implemented by national law, such as:

      (a) the right to interpretation and translation, as provided for in Directive 2010/64/EU;

      (b) the right to information and access to the case materials, as provided for in Directive 2012/13/EU;

      (c) the right of access to a lawyer and the right to communicate with and have third persons informed in the event of detention, as provided for in Directive 2013/48/EU;

      (d) the right to remain silent and the right to be presumed innocent as provided for in Directive (EU) 2016/343;

      (e) the right to legal aid as provided for in Directive (EU) 2016/1919.

      3.   Without prejudice to the rights referred to in this Chapter, suspects and accused persons as well as other persons involved in the proceedings of the EPPO shall have all the procedural rights available to them under the applicable national law, including the possibility to present evidence, to request the appointment of experts or expert examination and hearing of witnesses, and to request the EPPO to obtain such measures on behalf of the defence.

      Article 47: Principles relating to processing of personal data

      1.   Personal data shall be:

      (a) processed lawfully and fairly (‘lawfulness and fairness’);

      (b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes provided that the EPPO provides appropriate safeguards for the rights and freedoms of data subjects (‘purpose limitation’);

      (c) adequate, relevant, and not excessive in relation to the purposes for which they are processed (‘data minimisation’);

      (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

      (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes provided that the EPPO provides appropriate safeguards for the rights and freedoms of data subjects, in particular by the implementation of the appropriate technical and organisational measures required by this Regulation (‘storage limitation’);

      (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

      2.   The EPPO shall be responsible for, and be able to demonstrate compliance with paragraph 1 (‘accountability’) when processing personal data wholly or partly by automated means and when processing other than by automated means personal data which form part of a filing system or are intended to form part of a filing system.

      3.   Processing by the EPPO for any of the purposes set out in Article 49 other than that for which the operational personal data are collected shall be permitted in so far as:

      (a) the EPPO is authorised to process such operational personal data for such a purpose in accordance with this Regulation; and

      (b) processing is necessary and proportionate to that other purpose in accordance with Union law; and

      (c) where relevant, the use of operational personal data is not prohibited by the applicable national procedural law on the investigative measures taken in accordance with Article 30. The applicable national procedural law is the law of the Member State where the data was obtained.

    • Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence

      Preamble 


      (28) Aside from the many beneficial uses of AI, it can also be misused and provide novel and powerful tools for manipulative, exploitative and social control practices. Such practices are particularly harmful and abusive and should be prohibited because they contradict Union values of respect for human dignity, freedom, equality, democracy and the rule of law and fundamental rights enshrined in the Charter, including the right to non-discrimination, to data protection and to privacy and the rights of the child.


      (48) The extent of the adverse impact caused by the AI system on the fundamental rights protected by the Charter is of particular relevance when classifying an AI system as high risk. Those rights include the right to human dignity, respect for private and family life, protection of personal data, freedom of expression and information, freedom of assembly and of association, the right to non-discrimination, the right to education, consumer protection, workers’ rights, the rights of persons with disabilities, gender equality, intellectual property rights, the right to an effective remedy and to a fair trial, the right of defence and the presumption of innocence, and the right to good administration. In addition to those rights, it is important to highlight the fact that children have specific rights as enshrined in Article 24 of the Charter and in the United Nations Convention on the Rights of the Child, further developed in the UNCRC General Comment No 25 as regards the digital environment, both of which require consideration of the children’s vulnerabilities and provision of such protection and care as necessary for their well-being. The fundamental right to a high level of environmental protection enshrined in the Charter and implemented in Union policies should also be considered when assessing the severity of the harm that an AI system can cause, including in relation to the health and safety of persons.

      Article 1: Subject matter

      1.   The purpose of this Regulation is to improve the functioning of the internal market and promote the uptake of human-centric and trustworthy artificial intelligence (AI), while ensuring a high level of protection of health, safety, fundamental rights enshrined in the Charter, including democracy, the rule of law and environmental protection, against the harmful effects of AI systems in the Union and supporting innovation.

    • Directive (EU) 2024/2831 of the European Parliament and of the Council of 23 October 2024 on improving working conditions in platform work

      Preamble 


      (2) Article 31 of the Charter of Fundamental Rights of the European Union (the ‘Charter’) provides for the right of every worker to fair and just working conditions which respect his or her health, safety and dignity. Article 27 of the Charter protects the workers’ right to information and consultation within the undertaking. Article 8 of the Charter provides that everyone has the right to the protection of personal data concerning him or her. Article 12 of the Charter provides that everyone has the right to freedom of assembly and of association at all levels. Article 16 of the Charter recognises the freedom to conduct a business. Article 21 of the Charter prohibits discrimination.

      Article 7: Limitations on the processing of personal data by means of automated monitoring systems or automated decision-making systems

      1.   Digital labour platforms shall not, by means of automated monitoring systems or automated decision-making systems:

      (a) process any personal data on the emotional or psychological state of a person performing platform work;

      (b) process any personal data in relation to private conversations, including exchanges with other persons performing platform work and the representatives of persons performing platform work;

      (c) collect any personal data of a person performing platform work while that person is not offering or performing platform work;

      (d) process personal data to predict the exercise of fundamental rights, including the freedom of association, the right of collective bargaining and action or the right to information and consultation as laid down in the Charter;

      (e) process any personal data to infer the racial or ethnic origin, migration status, political opinions, religious or philosophical beliefs, disability, state of health, including chronic disease or HIV status, emotional or psychological state, trade union membership, sex life or sexual orientation;

      (f) process any biometric data, as defined in Article 4, point (14), of Regulation (EU) 2016/679, of a person performing platform work to establish that person’s identity by comparing that data to stored biometric data of natural persons in a database.

    • Regulation (EU) 2024/1083 of the European Parliament and of the Council of 11 April 2024 establishing a common framework for media services in the internal market and amending Directive 2010/13/EU

      Preamble 


      (15) This Regulation does not affect the freedom of expression and information guaranteed to individuals under the Charter. The European Court of Human Rights has observed that in such a sensitive sector as the audiovisual media sector, in addition to its negative duty of non-interference, the public powers have a positive obligation to put in place an appropriate legislative and administrative framework to guarantee effective media pluralism


      (20) In order to avoid circumvention of the protection of journalistic sources and confidential communications and guarantee adequate respect for one’s private and family life, home and communications in accordance with the Charter, safeguards should also apply to persons who, because of their regular private or professional relationship with media service providers or members of their editorial staff, are likely to have information that could identify journalistic sources or confidential communications. That should include persons living in a close relationship in a joint household and on a stable and continuous basis and persons who are or have been professionally involved in the preparation, production or dissemination of programmes or press publications and who are only targeted due to their close links with media service providers, journalists or other members of the editorial staff. The protection of journalistic sources and confidential communications should also benefit the staff of media service providers, such as the technical staff, including cybersecurity experts, who could be targeted given the important support role they provide to journalists in their daily work, which requires solutions to ensure the confidentiality of journalists’ work, and the resulting likelihood that they have access to information concerning journalistic sources or confidential communications.

      (21) Protecting journalistic sources and confidential communications is consistent with and contributes to the protection of the fundamental right enshrined in Article 11 of the Charter. It is also crucial for safeguarding the ‘public watchdog’ role of media service providers and, in particular investigative journalists in democratic societies and for upholding the rule of law. In light thereof, ensuring an adequate level of protection for journalistic sources and confidential communications requires that measures for obtaining such information be authorised by an authority that can independently and impartially assess whether it is justified by an overriding reason of public interest, such as a court, a judge, a prosecutor acting in a judicial capacity, or another such authority with competence to authorise those measures in accordance with national law. It also requires that surveillance measures be subject to regular review by such an authority to ascertain whether the conditions justifying the use of the measure in question continue to be fulfilled. That requirement is also met where the purpose of the regular review is to verify whether the conditions justifying an extension of the authorisation for the use of the measure have been fulfilled.


      (26) Intrusive surveillance software should only be deployed where it is justified by an overriding reason of public interest, it is provided for in Union or national law, it is in compliance with Article 52(1) of the Charter as interpreted by the Court of Justice and with other Union law, it has been authorised ex ante or, in exceptional and urgent cases, subsequently confirmed by a judicial authority or an independent and impartial decision-making authority, it occurs in investigations of offences listed in Article 2(2) of Council Framework Decision 2002/584/JHA (9) punishable in the Member State concerned by a custodial sentence or a detention order of a maximum period of at least three years or in investigations of other serious offences punishable in the Member State concerned by a custodial sentence or a detention order of a maximum period of at least five years, as determined by the national law of that Member State, and provided that no other less restrictive measure would be adequate and sufficient to obtain the information sought. According to the principle of proportionality, limitations can be made to an individual’s rights and freedoms only if they are necessary and genuinely meet objectives of general interest recognised by the Union. Thus, as regards specifically the deployment of intrusive surveillance software, it is necessary to ascertain whether the offence in question attains a threshold of seriousness as laid down in this Regulation, whether, following an individual assessment of all the relevant circumstances in a given case, the investigation and prosecution of that offence merit the particularly intrusive interference with fundamental rights and economic freedoms consisting in the deployment of intrusive surveillance software, whether there is sufficient evidence that the offence in question has been committed, and whether the deployment of intrusive surveillance software is relevant for the purpose of establishing the facts related to the investigation and prosecution of that offence.


      (77) This Regulation respects the fundamental rights and observes the principles recognised by the Charter, in particular Articles 7, 8, 11, 16, 47, 50 and 52 thereof. Accordingly, this Regulation should be interpreted and applied with due respect for those rights and principles. In particular, nothing in this Regulation should be interpreted as interfering with the freedom of information, editorial freedom or the freedom of the press as enshrined in national constitutional law that is consistent with the Charter or as incentivising Member States to introduce requirements for the editorial content of press publications.

      Article 4: Rights of media service providers 

      4.   By way of derogation from paragraph 3, points (a) and (b), of this Article, Member States may take a measure referred to therein, provided that it:

      (a) is provided for by Union or national law;

      (b) is in compliance with Article 52(1) of the Charter and other Union law;

      (c) is justified on a case-by-case basis by an overriding reason of public interest and is proportionate; and

      (d) is subject to prior authorisation by a judicial authority or an independent and impartial decision-making authority or, in duly justified exceptional and urgent cases, is subsequently authorised by such an authority without undue delay.

      8.   Member States shall ensure that media service providers, their editorial staff or any persons who, because of their regular or professional relationship with a media service provider or its editorial staff, might have information related to or capable of identifying journalistic sources or confidential communications have a right to effective judicial protection, in line with Article 47 of the Charter, in cases regarding breaches of paragraphs 3 to 7 of this Article.

      Article 6: Duties of media services providers

      3.   Without prejudice to national constitutional law consistent with the Charter, media service providers providing news and current affairs content shall take measures that they deem appropriate with a view to guaranteeing the independence of editorial decisions. In particular, such measures shall aim to:

      (a) guarantee that editorial decisions can be taken freely within the established editorial line of the media service provider concerned; and

      (b) ensure that any actual or potential conflicts of interest that might affect the provision of news and current affairs content are disclosed.

    • Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector

      Preamble 

      (2) This Directive seeks to respect the fundamental rights and observes the principles recognised in particular by the Charter of fundamental rights of the European Union. In particular, this Directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of that Charter.

    • Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa

      Preamble  

      (40) This Regulation provides for new data processing operations aimed at identifying the persons concerned correctly. This constitutes an interference with their fundamental rights as protected by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Since the effective implementation of the EU information systems is dependent upon correct identification of the individuals concerned, such interference is justified by the same objectives for which each of those systems have been established, the effective management of the Union's borders, the internal security of the Union and the effective implementation of the Union's asylum and visa policies.

    • Regulation (EU) 2024/1358 of the European Parliament and of the Council of 14 May 2024 on the establishment of ‘Eurodac’ for the comparison of biometric data

      Preamble 

      (94) This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter. In particular, this Regulation seeks to ensure full respect for the protection of personal data and for the right to seek international protection, and to promote the application of Articles 8 and 18 of the Charter. This Regulation should therefore be applied accordingly.

      Article 13: Obligation to take biometric data 

      6.   The procedure for taking biometric data shall be determined and applied in accordance with the national practice of the Member State concerned and in accordance with the safeguards laid down in the Charter and in the European Convention for the Protection of Human Rights and Fundamental Freedoms.

    • Regulation (EU) No 656/2014 of the European Parliament and of the Council of 15 May 2014 establishing rules for the surveillance of the external sea borders in the context of operational cooperation coordinated by Frontex

      Preamble 


      (19) This Regulation respects the fundamental rights and observes the principles recognised by Articles 2 and 6 of the Treaty on European Union (TEU) and by the Charter, in particular respect for human dignity, the right to life, the prohibition of torture and of inhuman or degrading treatment or punishment, the prohibition of trafficking in human beings, the right to liberty and security, the right to the protection of personal data, the right to asylum and to protection against removal and expulsion, the principles of non-refoulement and non-discrimination, the right to an effective remedy and the rights of the child. This Regulation should be applied by Member States and the Agency in accordance with those rights and principles.

    • Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information

      .

    • Directive (EU) 2019/1153 of the European Parliament and of the Council of 20 June 2019 laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences, and

      .

    3 results found

    • European Convention on Human Rights - Article 8

      Article 8 – Right to respect for private and family life

      1. Everyone has the right to respect for his private and family life, his home and his correspondence.

      2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

    • Council of Europe, Guidelines on the protection of individuals with regard to the processing of personal data in a world of big data

      ‘The present Guidelines recommend measures that Parties, controllers and processors should take to prevent the potential negative impact of the use of Big Data on human dignity, human rights, and fundamental individual and collective freedoms, in particular with regard to personal data protection.
      Given the nature of Big Data and its uses, the application of some of the traditional principles of data processing (e.g. the principle of data minimisation, purpose limitation, fairness and transparency, and free, specific and informed consent) may be challenging in this technological scenario. These Guidelines therefore suggest a specific application of the principles of Convention 108, to make them more effective in practice in the Big Data context.‘

    • OECD, Guidelines governing the Protection of Privacy and Transborder Flows of Personal Data

      ‘2. These Guidelines apply to personal data, whether in the public or private sectors, which, because of the manner in which they are processed, or because of their nature or the context in which they are used, pose a risk to privacy and individual liberties.‘
      ‘3. The principles in these Guidelines are complementary and should be read as a whole. They should not be interpreted:
      a) as preventing the application of different protective measures to different categories of personal data, depending upon their nature and the context in which they are collected, stored, processed or disseminated; or
      b) in a manner which unduly limits the freedom of expression‘
      ‘7. There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.‘
      ‘9. The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.‘