3386 GOVERNMENT GAZETTE A’ 137/29.08.2019 Article 25 Processing of personal data for other purposes by private bodies Article 27 Processing of personal data in the context of employment 1. The processing of personal data by private bodies for a purpose other than that for which they have been collected shall be permitted, where necessary: (a) for the prevention of threats to national or public security at the request of a public body; or (b) for the prosecution of criminal offences; or (c) for the establishment, exercise or defence of legal claims, unless the interests of the data subject override the grounds for the processing of those data. 2. The processing of special categories of personal data, as referred to in Article 9(1) of the GDPR, for a purpose other than that for which they have been collected, shall be permitted, provided that the conditions set out in the previous paragraph are fulfilled and one of the exemptions provided for in Article 9(2) of the GDPR or Article 22 of this Law applies. 1. Employees’ personal data may be processed for the purposes of the contract of employment where the processing is strictly necessary for deciding whether to enter into a contract of employment, or for the performance of a contract of employment once it has been concluded. 2. Where an employee’s consent is, by way of exception, used as the legal basis for the processing of the employee’s personal data, the following should be taken into account in deciding whether consent was freely given, and in particular: (a) the employee’s dependence, as set out in the contract of employment and (b) the circumstances under which consent was given. Consent can be given either in writing or in electronic form and must be clearly distinguishable from the contract of employment. The employer must inform the employee, either in writing or in electronic form, about the purpose of the processing of the employee’s personal data and his or her right to withdraw consent under Article 7(3) of the GDPR. 3. By way of derogation from Article 9(1) of the GDPR, processing of special categories of personal data within the meaning of Article 9(1) of the GDPR for the purposes of the contract of employment shall be permitted if it is necessary for the exercise of their rights or for compliance with legal obligations arising from employment, social security and social protection law, and there is no reason to believe that the data subject’s legitimate interests in relation to processing take precedence. Paragraph 2 shall also apply to consent given for the processing of special categories of personal data. Consent should explicitly refer to such data. Article 22(3)(b) shall apply accordingly. 4. The processing of personal data, including special categories of the employees’ personal data, shall be permitted for the purposes of the contract of employment on the basis of collective labour agreements. The negotiating parties shall comply with Article 88(2) of the GDPR. 5. The controller shall take appropriate measures to ensure that, in particular, the principles for the processing of personal data laid down in Article 5 of the GDPR are complied with. 6. Paragraphs 1 to 5 shall also apply where personal data, including special categories of employees’ personal data, are subject to processing, without being stored or intended to be stored in a filing system. 7. Processing of personal data through closed circuit television systems in the workplace, whether publicly accessible or not, shall only be permitted if it is necessary for the protection of persons and goods. Data collected through a closed circuit television system cannot be used as a criterion for assessing the performance of employees. The employees shall be informed in writing or electronically of the installation and operation of a closed circuit television system in the workplace. 8. For the purposes of this Law, employees mean workers recruited under any type of employment relationship, or a work contract, or a service contract in the public and private Article 26 Transfer of personal data by public bodies 1. The transfer of personal data by a public body to another public body shall be permitted, where necessary for the performance of the tasks of the transmitting body or the third party to whom the data were transferred, provided that the conditions enabling the processing under Article 24 are met. The third party to whom the data have been transferred shall process them only for the purpose for which they were transferred. Processing for other purposes shall be permitted only if the conditions laid down in Article 24 are met. 2. Public bodies shall be permitted to transfer personal data to private bodies, provided that: (a) the transfer is necessary for the performance of the tasks of the body transferring the data, and the conditions set out in Article 24 are met; (b) the third party to whom the data have been transferred has a legitimate interest in being aware of the transfer, and the data subject does not have a legitimate interest in not transferring the data relating to him or her; or (c) the processing is necessary for the establishment, exercise or defence of legal claims and the third party has pledged to the public body which has transferred the data that he or she will process the data only for the purpose for which they were transmitted. Processing for other purposes shall be permitted if the transfer is authorised in accordance with paragraph 1 and the transmitting body has consented to the transfer. 3. The transfer of special categories of personal data within the meaning of Article 9(1) of the GDPR shall be permitted provided that the conditions set out in paragraph 1 or paragraph 2 are met and one of the exemptions in Article 9(2) of the GDPR or in accordance with Article 22 hereof applies.