Regulation (EU) 2016/794 of the European Parliament and of the CouncilShow full title

Article 28 General data protection principles

1. Personal data shall be:

(a) processed fairly and lawfully;

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Further processing of personal data for historical, statistical or scientific research purposes shall not be considered incompatible provided that Europol provides appropriate safeguards, in particular to ensure that data are not processed for any other purposes;

(c) adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;

(d) accurate and kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

(e) kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed; and

(f) processed in a manner that ensures appropriate security of personal data.

2. Europol shall make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data and the means available for the exercise of the rights of data subjects.