3392 GOVERNMENT GAZETTE by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Article 45 General Principles (Article 4 of the Directive) 1. Personal data must be: (a) processed lawfully and fairly; (b) collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes; (c) adequate, relevant and not excessive in relation to the purposes for which they are processed; (d) accurate and, where necessary, kept up to date; every reasonable step provided for by provisions in force must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay; (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed; (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. 2. The controller must be able to demonstrate compliance with his or her obligations pursuant to the previous paragraph. SECTION II LEGAL BASES FOR PROCESSING Article 46 Processing of special categories of personal data (Article 10 of the Directive) 1. Processing of special categories of personal data shall only be allowed where strictly necessary for the performance of the tasks of the controller. 2. Where special categories of personal data are processed, appropriate safeguards for the data subject’s protected legitimate interests shall apply. Appropriate safeguards may include in particular: (a) specific requirements for data security or for monitoring data protection; (b) specific time limits within which data should be reviewed for erasure; (c) measures to raise awareness of staff involved in processing operations; (d) restrictions on access to personal data within the controller (the competent body); (e) processing of such data using spatial and organisational separation; (f) pseudonymisation of personal data; (g) encryption of personal data; or (h) specific codes of conduct to ensure lawful processing in case of transfer or processing for other purposes. A’ 137/29.08.2019 Article 47 Processing for other purposes (Article 4 of the Directive) The processing of personal data for a purpose other than that for which they have been collected shall be permitted where that other purpose is one of the purposes referred to in Article 43, the controller is authorised to process data for that purpose and the processing carried out is necessary and proportionate to that other purpose. The processing of personal data for another purpose, which is not referred to in Article 43, shall be permitted where expressly provided for by law. Article 48 Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 4 of the Directive) Personal data may be processed in the context of the purposes referred to in Article 43 for archiving purposes in the public interest, or for scientific or historical research purposes or statistical purposes, if this is in the public interest and appropriate safeguards are applied in relation to the data subject’s protected legitimate rights. Such safeguards may consist in anonymising personal data as soon as possible, taking measures to prevent unauthorised third-party access or their processing using spatial and organisational separation from other specific tasks. Article 49 Consent 1. To the extent that the processing of personal data is based on consent by law, the controller must be able to demonstrate that the data subject has given his or her consent. 2. If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent should be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent given before its withdrawal. Prior to giving consent, the data subject shall be informed of this right. 4. Consent produces its legal effects only when it is based on the data subject’s free will. In assessing whether consent was freely given, account should be taken of the circumstances in which consent was given. The data subject shall be informed of the intended purpose of processing. If necessary, according to the circumstances of the case in question or upon request, the data subject shall also be informed of the consequences of the refusal of consent. 5. In case of special categories of personal data, consent must be explicitly referred to those data.