4
e) the personal data that is processed is adequate and relevant in relation to the purposes of
the processing,
f) no more personal data is processed than is necessary having regard to the purposes of the
processing,
g) the personal data that is processed is correct and, if it is necessary, up to date,
h) all reasonable measures are taken to correct, block or erase such personal data as is
incorrect or incomplete having regard to the purposes of the processing, and
i) personal data is not kept for a longer period than that as is necessary having regard to the
purpose of the processing.
However, as regards the first paragraph, d), the processing of personal data for historical,
statistic or scientific purposes shall not be regarded as incompatible with the purposes for
which the information was collected.
Personal data may be kept for historical, statistic or scientific purposes for a longer time than
that stated in the first paragraph i). However, personal data may not in such cases be kept for a
longer period than is necessary for these purposes.
Personal data that is processed for historical, statistical or scientific purposes may be used in
order to take measures as regards the person registered only if the person registered has given
his/her consent or there is extraordinary reason having regard to the vital interests of the
registered person.
When processing of personal data is permitted
Section 10
Personal data may be processed only if the registered person has given his/her consent to the
processing or if the processing is necessary in order
a) to enable the performance of a contract with the registered person or to enable measures
that the registered person has requested to be taken before a contract is entered into,
b) that the controller of personal data should be able to comply with a legal obligation,
c) that the vital interests of the registered person should be protected,
d) that a work task of public interest should be performed,
e) that the controller of personal data or a third party to whom the personal data is provided
should be able to perform a work task in conjunction with the exercise of official authority,
or
f) that a purpose that concerns a legitimate interest of the controller of personal data or of
such a third party to whom personal data is provided should be able to be satisfied, if this
interest is of greater weight than the interest of the registered person in protection against
violation of personal integrity.