Service provided by the Federal Ministry of Justice and the Federal Office of Justice ‒ www.gesetze-im-internet.de 12. ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person which allow or confirm the unique identification of that natural person, in particular facial images or dactyloscopic data; 13. ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; 14. ‘special categories of personal data’ a) data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; b) genetic data; c) biometric data for the purpose of uniquely identifying a natural person; d) data concerning health; and e) data concerning a natural person’s sex life or sexual orientation; 15. ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 41 of Directive (EU) 2016/680; 16. ‘international organization’ means an organization and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries; 17. ‘consent’ means any freely given, specific, informed and unambiguous indication of the data subject's wishes in a particular case by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Section 47 General principles for processing personal data Personal data shall be 1. processed lawfully and fairly; 2. collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes; 3. adequate, relevant and not excessive in relation to the purposes for which they are processed; 4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay; 5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed; 6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures. Chapter 2 Legal basis for processing personal data Page 26 of 43