(a) "personal data" shall mean any information of any type, irrespective of the type of
medium involved, including sound and image, relating to an identified or identifiable natural
person ("data subject"); an identifiable person is one who can be identified, directly or
indirectly, in particular by reference to an indication number or to one or more factors
specific to his physical, physiological, mental, economic, cultural or social identity;
(b) "processing of personal data" ("processing") shall mean any operation or set of
operations which is performed upon personal data, whether wholly or partly by automatic
means, such as collection, recording, organisation, storage, adaptation or alteration,
retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, blocking, erasure or destruction;
(c) "personal data filing system" ("filing system") shall mean any structured set of personal
data which are accessible according to specific criteria, whether centralised, decentralised or
dispersed on a functional or geographical basis;
(d) "controller" shall mean the natural or legal person, public authority, agency or any other
body which alone or jointly with others determines the purposes and means of the
processing of personal data; where the purposes and means of processing are determined by
laws or regulations, the controller shall be designated in the Act establishing the
organisation and functioning or in the statutes of the legal or statutory body competent to
process the personal data concerned;
(e) "processor" shall mean a natural or legal person, public authority, agency or any other
body which processes personal data on behalf of the controller;
(f) "third party" shall mean any natural or legal person, public authority, agency or any other
body other than the data subject, the controller, the processor and the persons who, under the
direct authority of the controller or the processor, are authorised to process the data;
(g) "recipient" shall mean a natural or legal person, public authority, agency or any other
body to whom data are disclosed, whether a third party or not; however, authorities which
may receive data in the framework of a law shall not be regarded as recipients;
(h) "the data subject’s consent" shall mean any freely given specific and informed indication
of his wishes by which the data subject signifies his agreement to personal data relating to
him being processed;
(i) "combination of data" shall mean a form of processing which consists of the possibility
of correlating data in a filing system with data in a filing system or systems kept by another
or other controllers or kept by the same controller for other purposes.
2/20