Blame for data.json

{"document": {"title": "General Data Protection Regulation (EU) 2016/679", "source": "Official Journal of the European Union, L 119, 4.5.2016", "pages": 88, "chunks": 305, "firstArticleChunk": 135, "chunkWords": 220, "overlapWords": 40}, "chunkIndex": [{"page": 1, "cite": "Recitals 1–2"}, {"page": 1, "cite": "Recitals 2–4"}, {"page": 1, "cite": "Recitals 4–5"}, {"page": 2, "cite": "Recitals 5–7"}, {"page": 2, "cite": "Recitals 7–9"}, {"page": 2, "cite": "Recital 10"}, {"page": 2, "cite": "Recital 11"}, {"page": 3, "cite": "Recitals 12–13"}, {"page": 3, "cite": "Recitals 14–15"}, {"page": 3, "cite": "Recitals 15–17"}, {"page": 3, "cite": "Recitals 17–2"}, {"page": 3, "cite": "Recitals 2–19"}, {"page": 4, "cite": "Recitals"}, {"page": 4, "cite": "Recital 20"}, {"page": 4, "cite": "Recitals 21–22"}, {"page": 4, "cite": "Recitals 1–23"}, {"page": 5, "cite": "Recital 24"}, {"page": 5, "cite": "Recitals 24–26"}, {"page": 5, "cite": "Recitals 26–27"}, {"page": 5, "cite": "Recitals 27–30"}, {"page": 5, "cite": "Recitals 30–32"}, {"page": 6, "cite": "Recitals 32–33"}, {"page": 6, "cite": "Recitals 33–35"}, {"page": 6, "cite": "Recitals 36–1"}, {"page": 6, "cite": "Recital 1"}, {"page": 7, "cite": "Recital 37"}, {"page": 7, "cite": "Recitals 38–39"}, {"page": 7, "cite": "Recitals"}, {"page": 7, "cite": "Recital 40"}, {"page": 8, "cite": "Recitals 41–42"}, {"page": 8, "cite": "Recital 43"}, {"page": 8, "cite": "Recitals 44–45"}, {"page": 8, "cite": "Recital 46"}, {"page": 8, "cite": "Recitals 46–47"}, {"page": 9, "cite": "Recitals"}, {"page": 9, "cite": "Recitals 48–49"}, {"page": 9, "cite": "Recital 50"}, {"page": 9, "cite": "Recitals"}, {"page": 10, "cite": "Recital 51"}, {"page": 10, "cite": "Recital 51"}, {"page": 10, "cite": "Recital 52"}, {"page": 10, "cite": "Recital 53"}, {"page": 10, "cite": "Recitals"}, {"page": 11, "cite": "Recitals 54–55"}, {"page": 11, "cite": "Recitals 55–57"}, {"page": 11, "cite": "Recitals 58–59"}, {"page": 11, "cite": "Recitals 59–60"}, {"page": 12, "cite": "Recital 61"}, {"page": 12, "cite": "Recitals 62–63"}, {"page": 12, "cite": "Recital 63"}, {"page": 12, "cite": "Recitals 64–65"}, {"page": 12, "cite": "Recitals"}, {"page": 13, "cite": "Recitals 66–67"}, {"page": 13, "cite": "Recital 68"}, {"page": 13, "cite": "Recitals"}, {"page": 13, "cite": "Recitals 69–70"}, {"page": 13, "cite": "Recitals 70–71"}, {"page": 14, "cite": "Recitals"}, {"page": 14, "cite": "Recitals 72–73"}, {"page": 14, "cite": "Recital 73"}, {"page": 14, "cite": "Recitals 74–75"}, {"page": 15, "cite": "Recital 76"}, {"page": 15, "cite": "Recitals 76–78"}, {"page": 15, "cite": "Recital 78"}, {"page": 15, "cite": "Recitals 79–80"}, {"page": 15, "cite": "Recitals"}, {"page": 16, "cite": "Recital 81"}, {"page": 16, "cite": "Recitals 82–83"}, {"page": 16, "cite": "Recitals 83–84"}, {"page": 16, "cite": "Recital 85"}, {"page": 16, "cite": "Recital 86"}, {"page": 17, "cite": "Recitals 87–88"}, {"page": 17, "cite": "Recital 89"}, {"page": 17, "cite": "Recitals 90–91"}, {"page": 17, "cite": "Recitals"}, {"page": 18, "cite": "Recitals 92–94"}, {"page": 18, "cite": "Recital 94"}, {"page": 18, "cite": "Recitals 95–97"}, {"page": 18, "cite": "Recital 98"}, {"page": 19, "cite": "Recitals 99–101"}, {"page": 19, "cite": "Recital 102"}, {"page": 19, "cite": "Recitals 103–104"}, {"page": 19, "cite": "Recitals 104–105"}, {"page": 20, "cite": "Recitals 105–106"}, {"page": 20, "cite": "Recital 107"}, {"page": 20, "cite": "Recital 108"}, {"page": 20, "cite": "Recitals 109–1"}, {"page": 20, "cite": "Recitals 1–111"}, {"page": 21, "cite": "Recitals 111–112"}, {"page": 21, "cite": "Recital 112"}, {"page": 21, "cite": "Recital 113"}, {"page": 21, "cite": "Recitals 114–115"}, {"page": 22, "cite": "Recital 116"}, {"page": 22, "cite": "Recitals 117–118"}, {"page": 22, "cite": "Recitals 118–121"}, {"page": 22, "cite": "Recitals 121–122"}, {"page": 22, "cite": "Recitals 122–123"}, {"page": 23, "cite": "Recital 124"}, {"page": 23, "cite": "Recitals 125–126"}, {"page": 23, "cite": "Recitals 126–127"}, {"page": 23, "cite": "Recital 128"}, {"page": 24, "cite": "Recital 129"}, {"page": 24, "cite": "Recital 130"}, {"page": 24, "cite": "Recitals 130–131"}, {"page": 24, "cite": "Recitals 132–133"}, {"page": 24, "cite": "Recitals 133–135"}, {"page": 25, "cite": "Recitals 136–137"}, {"page": 25, "cite": "Recitals 138–139"}, {"page": 25, "cite": "Recitals 140–141"}, {"page": 25, "cite": "Recital 142"}, {"page": 26, "cite": "Recitals 142–143"}, {"page": 26, "cite": "Recital 143"}, {"page": 26, "cite": "Recitals"}, {"page": 26, "cite": "Recital 144"}, {"page": 26, "cite": "Recitals 145–146"}, {"page": 27, "cite": "Recital 146"}, {"page": 27, "cite": "Recitals 147–148"}, {"page": 27, "cite": "Recital 149"}, {"page": 27, "cite": "Recitals 150–1"}, {"page": 28, "cite": "Recital 151"}, {"page": 28, "cite": "Recitals 152–153"}, {"page": 28, "cite": "Recital 154"}, {"page": 28, "cite": "Recitals 154–1"}, {"page": 28, "cite": "Recitals 1–155"}, {"page": 29, "cite": "Recital 156"}, {"page": 29, "cite": "Recital 157"}, {"page": 29, "cite": "Recitals 157–158"}, {"page": 29, "cite": "Recitals 158–159"}, {"page": 30, "cite": "Recitals 160–162"}, {"page": 30, "cite": "Recitals 162–163"}, {"page": 30, "cite": "Recitals 164–1"}, {"page": 30, "cite": "Recitals 1–2"}, {"page": 31, "cite": "Recitals 167–168"}, {"page": 31, "cite": "Recitals 169–171"}, {"page": 31, "cite": "Recitals 171–173"}, {"page": 31, "cite": "Arts. 290–1"}, {"page": 32, "cite": "Arts. 1–2"}, {"page": 32, "cite": "Arts. 2–3"}, {"page": 33, "cite": "Arts. 3–4"}, {"page": 33, "cite": "Art. 4"}, {"page": 33, "cite": "Art. 4"}, {"page": 34, "cite": "Art. 4"}, {"page": 34, "cite": "Art. 4"}, {"page": 34, "cite": "Art. 4"}, {"page": 34, "cite": "Art. 4"}, {"page": 35, "cite": "Arts. 4–5"}, {"page": 35, "cite": "Art. 5"}, {"page": 36, "cite": "Arts. 5–6"}, {"page": 36, "cite": "Art. 6"}, {"page": 36, "cite": "Art. 6"}, {"page": 36, "cite": "Art. 6"}, {"page": 37, "cite": "Arts. 6–7"}, {"page": 37, "cite": "Arts. 7–8"}, {"page": 37, "cite": "Arts. 8–9"}, {"page": 38, "cite": "Art. 9"}, {"page": 38, "cite": "Art. 9"}, {"page": 38, "cite": "Art. 9"}, {"page": 39, "cite": "Arts. 9–11"}, {"page": 39, "cite": "Arts. 10–12"}, {"page": 39, "cite": "Art. 12"}, {"page": 40, "cite": "Art. 12"}, {"page": 40, "cite": "Arts. 12–13"}, {"page": 40, "cite": "Arts. 12–13"}, {"page": 41, "cite": "Art. 13"}, {"page": 41, "cite": "Arts. 13–14"}, {"page": 41, "cite": "Arts. 13–14"}, {"page": 42, "cite": "Art. 14"}, {"page": 42, "cite": "Art. 14"}, {"page": 42, "cite": "Art. 14"}, {"page": 42, "cite": "Arts. 14–15"}, {"page": 43, "cite": "Art. 15"}, {"page": 43, "cite": "Arts. 15–17"}, {"page": 44, "cite": "Art. 17"}, {"page": 44, "cite": "Arts. 17–18"}, {"page": 44, "cite": "Art. 18"}, {"page": 44, "cite": "Arts. 18–20"}, {"page": 45, "cite": "Arts. 20–21"}, {"page": 45, "cite": "Art. 21"}, {"page": 46, "cite": "Arts. 21–22"}, {"page": 46, "cite": "Arts. 22–23"}, {"page": 46, "cite": "Art. 23"}, {"page": 47, "cite": "Arts. 23–24"}, {"page": 47, "cite": "Arts. 24–25"}, {"page": 48, "cite": "Arts. 25–26"}, {"page": 48, "cite": "Arts. 25–27"}, {"page": 48, "cite": "Arts. 26–27"}, {"page": 49, "cite": "Arts. 27–28"}, {"page": 49, "cite": "Art. 28"}, {"page": 49, "cite": "Art. 28"}, {"page": 50, "cite": "Art. 28"}, {"page": 50, "cite": "Art. 28"}, {"page": 50, "cite": "Arts. 28–30"}, {"page": 51, "cite": "Art. 30"}, {"page": 51, "cite": "Arts. 30–32"}, {"page": 51, "cite": "Arts. 30–32"}, {"page": 52, "cite": "Arts. 32–33"}, {"page": 52, "cite": "Art. 33"}, {"page": 52, "cite": "Arts. 33–34"}, {"page": 53, "cite": "Arts. 34–35"}, {"page": 53, "cite": "Arts. 34–35"}, {"page": 53, "cite": "Art. 35"}, {"page": 53, "cite": "Art. 35"}, {"page": 54, "cite": "Arts. 35–36"}, {"page": 54, "cite": "Art. 36"}, {"page": 54, "cite": "Arts. 36–37"}, {"page": 55, "cite": "Arts. 36–37"}, {"page": 55, "cite": "Arts. 37–38"}, {"page": 55, "cite": "Arts. 37–38"}, {"page": 56, "cite": "Arts. 38–39"}, {"page": 56, "cite": "Arts. 39–40"}, {"page": 56, "cite": "Art. 40"}, {"page": 57, "cite": "Art. 40"}, {"page": 57, "cite": "Art. 40"}, {"page": 57, "cite": "Arts. 40–41"}, {"page": 58, "cite": "Art. 41"}, {"page": 58, "cite": "Arts. 41–42"}, {"page": 58, "cite": "Arts. 41–42"}, {"page": 59, "cite": "Art. 42"}, {"page": 59, "cite": "Arts. 42–43"}, {"page": 59, "cite": "Art. 43"}, {"page": 60, "cite": "Art. 43"}, {"page": 60, "cite": "Art. 43"}, {"page": 60, "cite": "Arts. 43–44"}, {"page": 60, "cite": "Arts. 44–45"}, {"page": 61, "cite": "Art. 45"}, {"page": 61, "cite": "Art. 45"}, {"page": 61, "cite": "Art. 45"}, {"page": 61, "cite": "Arts. 45–46"}, {"page": 62, "cite": "Art. 46"}, {"page": 62, "cite": "Arts. 46–47"}, {"page": 62, "cite": "Art. 47"}, {"page": 63, "cite": "Art. 47"}, {"page": 63, "cite": "Art. 47"}, {"page": 63, "cite": "Arts. 47–48"}, {"page": 64, "cite": "Arts. 47–49"}, {"page": 64, "cite": "Art. 49"}, {"page": 64, "cite": "Art. 49"}, {"page": 64, "cite": "Art. 49"}, {"page": 65, "cite": "Arts. 49–51"}, {"page": 65, "cite": "Arts. 50–52"}, {"page": 65, "cite": "Arts. 51–52"}, {"page": 66, "cite": "Arts. 52–53"}, {"page": 66, "cite": "Arts. 53–54"}, {"page": 67, "cite": "Arts. 54–55"}, {"page": 67, "cite": "Arts. 55–56"}, {"page": 67, "cite": "Arts. 56–57"}, {"page": 68, "cite": "Arts. 56–57"}, {"page": 68, "cite": "Art. 57"}, {"page": 68, "cite": "Art. 57"}, {"page": 69, "cite": "Arts. 57–58"}, {"page": 69, "cite": "Art. 58"}, {"page": 70, "cite": "Art. 58"}, {"page": 70, "cite": "Art. 58"}, {"page": 70, "cite": "Arts. 58–60"}, {"page": 70, "cite": "Arts. 59–60"}, {"page": 71, "cite": "Art. 60"}, {"page": 71, "cite": "Art. 60"}, {"page": 71, "cite": "Arts. 60–61"}, {"page": 72, "cite": "Arts. 60–61"}, {"page": 72, "cite": "Art. 61"}, {"page": 72, "cite": "Arts. 61–62"}, {"page": 73, "cite": "Art. 62"}, {"page": 73, "cite": "Art. 62"}, {"page": 73, "cite": "Arts. 62–64"}, {"page": 73, "cite": "Art. 64"}, {"page": 74, "cite": "Art. 64"}, {"page": 74, "cite": "Art. 64"}, {"page": 74, "cite": "Arts. 64–65"}, {"page": 75, "cite": "Art. 65"}, {"page": 75, "cite": "Art. 65"}, {"page": 75, "cite": "Arts. 65–66"}, {"page": 75, "cite": "Arts. 66–67"}, {"page": 75, "cite": "Arts. 66–68"}, {"page": 76, "cite": "Arts. 68–70"}, {"page": 76, "cite": "Art. 70"}, {"page": 77, "cite": "Art. 70"}, {"page": 77, "cite": "Art. 70"}, {"page": 77, "cite": "Art. 70"}, {"page": 78, "cite": "Arts. 70–71"}, {"page": 78, "cite": "Arts. 70–74"}, {"page": 78, "cite": "Arts. 73–75"}, {"page": 79, "cite": "Arts. 75–76"}, {"page": 79, "cite": "Arts. 75–78"}, {"page": 80, "cite": "Arts. 77–79"}, {"page": 80, "cite": "Arts. 79–80"}, {"page": 80, "cite": "Arts. 79–81"}, {"page": 81, "cite": "Arts. 80–82"}, {"page": 81, "cite": "Art. 82"}, {"page": 81, "cite": "Arts. 82–83"}, {"page": 82, "cite": "Art. 83"}, {"page": 82, "cite": "Art. 83"}, {"page": 82, "cite": "Art. 83"}, {"page": 83, "cite": "Art. 83"}, {"page": 83, "cite": "Arts. 83–85"}, {"page": 83, "cite": "Arts. 85–86"}, {"page": 84, "cite": "Arts. 86–88"}, {"page": 84, "cite": "Arts. 88–89"}, {"page": 84, "cite": "Art. 89"}, {"page": 85, "cite": "Arts. 89–90"}, {"page": 85, "cite": "Arts. 90–91"}, {"page": 85, "cite": "Arts. 91–92"}, {"page": 86, "cite": "Arts. 92–94"}, {"page": 86, "cite": "Arts. 93–97"}, {"page": 87, "cite": "Arts. 96–98"}, {"page": 87, "cite": "Arts. 97–99"}], "chunkingExample": [{"chunk": 290, "page": 82, "cite": "Art. 83", "text": "to what extent, the controller or processor notified the infringement; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; (j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement. 3. If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement. 4. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43; (b) the obligations of the certification body pursuant to Articles 42 and 43; (c) the obligations of the monitoring body pursuant to Article 41(4). 5. Infringements"}, {"chunk": 291, "page": 82, "cite": "Art. 83", "text": "the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43; (b) the obligations of the certification body pursuant to Articles 42 and 43; (c) the obligations of the monitoring body pursuant to Article 41(4). 5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9; (b) the data subjects' rights pursuant to Articles 12 to 22; (c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; (d) any obligations pursuant to Member State law adopted under Chapter IX; (e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1). 6. Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000"}, {"chunk": 292, "page": 83, "cite": "Art. 83", "text": "provide access in violation of Article 58(1). 6. Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. 7. Without prejudice to the corrective powers of supervisory authorities pursuant to Article 58(2), each Member State may lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State. 8. The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process. 9. Where the legal system of the Member State does not provide for administrative fines, this Article may be applied in such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the administrative fines imposed by supervisory authorities. In any event, the fines imposed shall be effective, proportionate and dissuasive. Those Member"}], "models": {"bi": "all-MiniLM-L6-v2", "cross": "ms-marco-MiniLM-L-6-v2", "llm": "gemini-3.7-flash", "device": "cuda"}, "queries": [{"category": "keyword_trap", "query": "Does a startup with 10 staff have to maintain records of processing?", "goldSnippets": ["fewer than 250 persons"], "gold": [193], "baselineRank": 7, "rerankedRank": 3, "status": "restored", "candidates": [{"chunk": 296, "page": 84, "cite": "Arts. 88–89", "biRank": 1, "biScore": 0.4274, "ceRank": 10, "ceScore": -11.048, "text": "in particular for the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, protection of employer's or customer's property and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. 2. Those rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place. 3. Each Member State shall notify to the Commission those provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. Article 89 Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in", "gold": false}, {"chunk": 67, "page": 16, "cite": "Recitals 82–83", "biRank": 2, "biScore": 0.4252, "ceRank": 1, "ceScore": -6.222, "text": "the processor to the controller, setting out the subjectmatter and duration of the processing, the nature and purposes of the processing, the type of personal data and categories of data subjects, taking into account the specific tasks and responsibilities of the processor in the context of the processing to be carried out and the risk to the rights and freedoms of the data subject. The controller and processor may choose to use an individual contract or standard contractual clauses which are adopted either directly by the Commission or by a supervisory authority in accordance with the consistency mechanism and then adopted by the Commission. After the completion of the processing on behalf of the controller, the processor should, at the choice of the controller, return or delete the personal data, unless there is a requirement to store the personal data under Union or Member State law to which the processor is subject. (82) In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations. (83) In order to maintain security and to prevent processing in infringement of this", "gold": false}, {"chunk": 188, "page": 49, "cite": "Art. 28", "biRank": 3, "biScore": 0.4006, "ceRank": 9, "ceScore": -10.795, "text": "the conditions referred to in paragraphs 2 and 4 for engaging another processor; (e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III; (f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor; (g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data; (h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. With regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. 4. Where a processor engages another processor for carrying out specific processing activities on", "gold": false}, {"chunk": 124, "page": 29, "cite": "Recital 156", "biRank": 4, "biScore": 0.3983, "ceRank": 7, "ceScore": -10.467, "text": "context, in particular for the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee, the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. (156) The processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be subject to appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. Those safeguards should ensure that technical and organisational measures are in place in order to ensure, in particular, the principle of data minimisation. The further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards", "gold": false}, {"chunk": 200, "page": 53, "cite": "Art. 35", "biRank": 5, "biScore": 0.3972, "ceRank": 5, "ceScore": -10.313, "text": "natural person; (b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or (c) a systematic monitoring of a publicly accessible area on a large scale. 4. The supervisory authority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment pursuant to paragraph 1. The supervisory authority shall communicate those lists to the Board referred to in Article 68. 5. The supervisory authority may also establish and make public a list of the kind of processing operations for which no data protection impact assessment is required. The supervisory authority shall communicate those lists to the Board. 6. Prior to the adoption of the lists referred to in paragraphs 4 and 5, the competent supervisory authority shall apply the consistency mechanism referred to in Article 63 where such lists involve processing activities which are related to the offering of goods or services to data subjects or to the monitoring of their behaviour in several Member States, or may substantially affect the free movement of personal data within the Union. 7. The assessment shall contain at least: (a) a systematic description of the envisaged processing operations", "gold": false}, {"chunk": 28, "page": 7, "cite": "Recital 40", "biRank": 6, "biScore": 0.3959, "ceRank": 4, "ceScore": -9.715, "text": "for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing. (40) In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessity for compliance with the legal obligation to which the controller is subject or the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request", "gold": false}, {"chunk": 193, "page": 51, "cite": "Arts. 30–32", "biRank": 7, "biScore": 0.3905, "ceRank": 3, "ceScore": -9.076, "text": "data to a third country or an international organisation, including the identifi­ cation of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards; (d) where possible, a general description of the technical and organisational security measures referred to in Article 32(1). 3. The records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form. 4. The controller or the processor and, where applicable, the controller's or the processor's representative, shall make the record available to the supervisory authority on request. 5. The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10. Article 31 Cooperation with the supervisory authority The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks. Section 2 Security of personal data Article 32 Security", "gold": true}, {"chunk": 195, "page": 52, "cite": "Arts. 32–33", "biRank": 8, "biScore": 0.3887, "ceRank": 8, "ceScore": -10.63, "text": "the processing. 2. In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. 3. Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article. 4. The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law. Article 33 Notification of a personal data breach to the supervisory authority 1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and", "gold": false}, {"chunk": 8, "page": 3, "cite": "Recitals 14–15", "biRank": 9, "biScore": 0.3853, "ceRank": 2, "ceScore": -7.262, "text": "States as well as effective cooperation between the supervisory authorities of different Member States. The proper functioning of the internal market requires that the free movement of personal data within the Union is not restricted or prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data. To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping. In addition, the Union institutions and bodies, and Member States and their supervisory authorities, are encouraged to take account of the specific needs of micro, small and medium-sized enterprises in the application of this Regulation. The notion of micro, small and medium-sized enterprises should draw from Article 2 of the Annex to Commission Recommendation 2003/361/EC (1). (14) The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person. (15) In order to prevent creating a serious risk of circumvention, the protection", "gold": false}, {"chunk": 147, "page": 36, "cite": "Arts. 5–6", "biRank": 10, "biScore": 0.3841, "ceRank": 6, "ceScore": -10.446, "text": "no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). 2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). Article 6 Lawfulness of processing 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for", "gold": false}], "answers": {"baseline": "Based on the provided context, it is not possible to answer whether a startup with 10 staff specifically has to maintain records of processing activities, as the passages do not contain information or exemptions regarding organization size or employee thresholds. \n\nThe context only states generally in Recital (82) (Passage 2) that:\n> *\"In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.\"*\n\nBecause the specific rules, conditions, or exceptions relating to staff size (such as Article 30(5)) are not included in the provided text, the context does not provide a definitive answer for a 10-person startup.", "reranked": "Based on the provided context, a startup with 10 staff (qualifying as an enterprise or organization employing fewer than 250 persons) is **generally exempt** from the obligation to maintain records of processing activities, **unless** specific conditions apply.\n\nAccording to **Article 30(5)** (and Recital 13), the record-keeping obligation does not apply to an enterprise or organisation employing fewer than 250 persons, **unless**:\n* the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects,\n* the processing is not occasional, or\n* the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.\n\nIf any of these conditions are met, the startup must maintain records of its processing activities."}}, {"category": "keyword_trap", "query": "How long can personal data be stored?", "goldSnippets": ["for no longer than is necessary for the purposes"], "gold": [146], "baselineRank": null, "rerankedRank": null, "status": "both-miss", "candidates": [{"chunk": 147, "page": 36, "cite": "Arts. 5–6", "biRank": 1, "biScore": 0.63, "ceRank": 1, "ceScore": 4.279, "text": "no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). 2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). Article 6 Lawfulness of processing 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for", "gold": false}, {"chunk": 28, "page": 7, "cite": "Recital 40", "biRank": 2, "biScore": 0.5732, "ceRank": 2, "ceScore": 4.081, "text": "for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing. (40) In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessity for compliance with the legal obligation to which the controller is subject or the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request", "gold": false}, {"chunk": 124, "page": 29, "cite": "Recital 156", "biRank": 3, "biScore": 0.5421, "ceRank": 7, "ceScore": -4.38, "text": "context, in particular for the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee, the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. (156) The processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be subject to appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. Those safeguards should ensure that technical and organisational measures are in place in order to ensure, in particular, the principle of data minimisation. The further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards", "gold": false}, {"chunk": 48, "page": 12, "cite": "Recitals 62–63", "biRank": 4, "biScore": 0.5366, "ceRank": 6, "ceScore": -3.456, "text": "disclosed to another recipient, the data subject should be informed when the personal data are first disclosed to the recipient. Where the controller intends to process the personal data for a purpose other than that for which they were collected, the controller should provide the data subject prior to that further processing with information on that other purpose and other necessary information. Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided. (62) However, it is not necessary to impose the obligation to provide information where the data subject already possesses the information, where the recording or disclosure of the personal data is expressly laid down by law or where the provision of information to the data subject proves to be impossible or would involve a dispropor­ tionate effort. The latter could in particular be the case where processing is carried out for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. In that regard, the number of data subjects, the age of the data and any appropriate safeguards adopted should be taken into consideration. (63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that", "gold": false}, {"chunk": 50, "page": 12, "cite": "Recitals 64–65", "biRank": 5, "biScore": 0.5093, "ceRank": 10, "ceScore": -5.222, "text": "would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates. (64) The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests. (65) A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer", "gold": false}, {"chunk": 169, "page": 42, "cite": "Arts. 14–15", "biRank": 6, "biScore": 0.4948, "ceRank": 3, "ceScore": -1.447, "text": "Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or (d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy. Article 15 Right of access by the data subject 1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are", "gold": false}, {"chunk": 49, "page": 12, "cite": "Recital 63", "biRank": 7, "biScore": 0.4876, "ceRank": 4, "ceScore": -1.715, "text": "the age of the data and any appropriate safeguards adopted should be taken into consideration. (63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software.", "gold": false}, {"chunk": 127, "page": 29, "cite": "Recitals 158–159", "biRank": 8, "biScore": 0.4825, "ceRank": 8, "ceScore": -4.51, "text": "State law. (158) Where personal data are processed for archiving purposes, this Regulation should also apply to that processing, bearing in mind that this Regulation should not apply to deceased persons. Public authorities or public or private bodies that hold records of public interest should be services which, pursuant to Union or Member State law, have a legal obligation to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest. Member States should also be authorised to provide for the further processing of personal data for archiving purposes, for example with a view to providing specific information related to the political behaviour under former totalitarian state regimes, genocide, crimes against humanity, in particular the Holocaust, or war crimes. (159) Where personal data are processed for scientific research purposes, this Regulation should also apply to that processing. For the purposes of this Regulation, the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research. In addition, it should take into account the Union's objective under Article 179(1) TFEU of achieving a European Research Area. Scientific research purposes should also include studies conducted in the public interest in the area of public", "gold": false}, {"chunk": 171, "page": 43, "cite": "Arts. 15–17", "biRank": 9, "biScore": 0.4806, "ceRank": 9, "ceScore": -5.072, "text": "by the data subject, the information shall be provided in a commonly used electronic form. 4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Section 3 Rectification and erasure Article 16 Right to rectification The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Article 17 Right to erasure (‘right to be forgotten’) 1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the", "gold": false}, {"chunk": 55, "page": 13, "cite": "Recitals 69–70", "biRank": 10, "biScore": 0.4757, "ceRank": 5, "ceScore": -2.339, "text": "data subject to obtain the erasure of personal data and the limitations of that right as set out in this Regulation and should, in particular, not imply the erasure of personal data concerning the data subject which have been provided by him or her for the performance of a contract to the extent that and for as long as the personal data are necessary for the performance of that contract. Where technically feasible, the data subject should have the right to have the personal data transmitted directly from one controller to another. (69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject. (70) Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that", "gold": false}]}, {"category": "exception", "query": "Must every company appoint a data protection officer?", "goldSnippets": ["core activities of the controller or the processor consist of processing operations"], "gold": [205], "baselineRank": 4, "rerankedRank": 1, "status": "restored", "candidates": [{"chunk": 206, "page": 55, "cite": "Arts. 37–38", "biRank": 1, "biScore": 0.6881, "ceRank": 2, "ceScore": 1.351, "text": "establishment. 3. Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size. 4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors. 5. The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39. 6. The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract. 7. The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority. Article 38 Position of the data protection officer 1. The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.", "gold": false}, {"chunk": 207, "page": 55, "cite": "Arts. 37–38", "biRank": 2, "biScore": 0.6679, "ceRank": 4, "ceScore": 0.711, "text": "Article 38 Position of the data protection officer 1. The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data. 2. The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge. 3. The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor. 4. Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation. 5. The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law. 6. The data protection officer may fulfil other tasks and duties. The controller or processor shall", "gold": false}, {"chunk": 208, "page": 56, "cite": "Arts. 38–39", "biRank": 3, "biScore": 0.6216, "ceRank": 3, "ceScore": 1.274, "text": "officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law. 6. The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests. Article 39 Tasks of the data protection officer 1. The data protection officer shall have at least the following tasks: (a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions; (b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits; (c) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35; (d) to cooperate with the supervisory authority; (e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard", "gold": false}, {"chunk": 205, "page": 55, "cite": "Arts. 36–37", "biRank": 4, "biScore": 0.592, "ceRank": 1, "ceScore": 1.37, "text": "processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health. Section 4 Data protection off icer Article 37 Designation of the data protection officer 1. The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10. 2. A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment. 3. Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size. 4. In cases other", "gold": true}, {"chunk": 272, "page": 75, "cite": "Arts. 66–68", "biRank": 5, "biScore": 0.5781, "ceRank": 8, "ceScore": -4.046, "text": "be adopted within two weeks by simple majority of the members of the Board. Article 67 Exchange of information The Commission may adopt implementing acts of general scope in order to specify the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in Article 64. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). Section 3 European data protection board Article 68 European Data Protection Board 1. The European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal personality. 2. The Board shall be represented by its Chair. 3. The Board shall be composed of the head of one supervisory authority of each Member State and of the European Data Protection Supervisor, or their respective representatives. 4. Where in a Member State more than one supervisory authority is responsible for monitoring the application of the provisions pursuant to this Regulation, a joint representative shall be appointed in accordance with that Member State's law. 5. The Commission shall have the right to participate in the activities and meetings of the Board without voting right. The Commission shall designate a representative. The Chair of the Board shall communicate", "gold": false}, {"chunk": 108, "page": 25, "cite": "Recitals 140–141", "biRank": 6, "biScore": 0.569, "ceRank": 5, "ceScore": -0.842, "text": "of Individuals with Regard to the Processing of Personal Data established by Directive 95/46/EC. It should consist of the head of a supervisory authority of each Member State and the European Data Protection Supervisor or their respective representatives. The Commission should participate in the Board's activities without voting rights and the European Data Protection Supervisor should have specific voting rights. The Board should contribute to the consistent application of this Regulation throughout the Union, including by advising the Commission, in particular on the level of protection in third countries or international organisations, and promoting cooperation of the supervisory authorities throughout the Union. The Board should act independently when performing its tasks. (140) The Board should be assisted by a secretariat provided by the European Data Protection Supervisor. The staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this Regulation should perform its tasks exclusively under the instructions of, and report to, the Chair of the Board. (141) Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights", "gold": false}, {"chunk": 85, "page": 20, "cite": "Recital 108", "biRank": 7, "biScore": 0.5557, "ceRank": 6, "ceScore": -2.153, "text": "no longer ensures an adequate level of data protection. Consequently the transfer of personal data to that third country or international organisation should be prohibited, unless the requirements in this Regulation relating to transfers subject to appropriate safeguards, including binding corporate rules, and derogations for specific situations are fulfilled. In that case, provision should be made for consultations between the Commission and such third countries or international organisations. The Commission should, in a timely manner, inform the third country or international organisation of the reasons and enter into consultations with it in order to remedy the situation. (108) In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority. Those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective adminis­ trative or judicial redress and to claim compensation, in the", "gold": false}, {"chunk": 86, "page": 20, "cite": "Recitals 109–1", "biRank": 8, "biScore": 0.5552, "ceRank": 9, "ceScore": -5.184, "text": "the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective adminis­ trative or judicial redress and to claim compensation, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default. Transfers may also be carried out by public authorities or bodies with public authorities or bodies in third countries or with international organisations with corresponding duties or functions, including on the basis of provisions to be inserted into administrative arrangements, such as a memorandum of understanding, providing for enforceable and effective rights for data subjects. Authorisation by the competent supervisory authority should be obtained when the safeguards are provided for in administrative arrangements that are not legally binding. (109) The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should prevent controllers or processors neither from including the (1) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission's exercise of implementing powers (OJ", "gold": false}, {"chunk": 231, "page": 63, "cite": "Art. 47", "biRank": 9, "biScore": 0.5494, "ceRank": 7, "ceScore": -3.277, "text": "of personal data, measures to ensure data security, and the requirements in respect of onward transfers to bodies not bound by the binding corporate rules; (e) the rights of data subjects in regard to processing and the means to exercise those rights, including the right not to be subject to decisions based solely on automated processing, including profiling in accordance with Article 22, the right to lodge a complaint with the competent supervisory authority and before the competent courts of the Member States in accordance with Article 79, and to obtain redress and, where appropriate, compensation for a breach of the binding corporate rules; (f) the acceptance by the controller or processor established on the territory of a Member State of liability for any breaches of the binding corporate rules by any member concerned not established in the Union; the controller or the processor shall be exempt from that liability, in whole or in part, only if it proves that that member is not responsible for the event giving rise to the damage; (g) how the information on the binding corporate rules, in particular on the provisions referred to in points (d), (e) and (f) of this paragraph is provided to the data subjects in addition to Articles 13 and 14; (h) the tasks of any data protection officer designated", "gold": false}, {"chunk": 247, "page": 68, "cite": "Art. 57", "biRank": 10, "biScore": 0.5415, "ceRank": 10, "ceScore": -5.372, "text": "inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary; (g) cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation; (h) conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority; (i) monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices; (j) adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2); (k) establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4); (l) give advice on the processing operations referred to in Article 36(2); (m) encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5); (n) encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5); (o)", "gold": false}], "answers": {"baseline": "Based on the provided context, **no, not every company is required to appoint a data protection officer.**\n\nAccording to Passage 1 (paragraph 4):\n* In cases other than those referred to in paragraph 1, a controller or processor **\"may or, where required by Union or Member State law shall, designate a data protection officer.\"** \n\n**Conditions and Missing Context:**\n* Designation is voluntary (\"may\") unless required by Union or Member State law (\"shall\").\n* While paragraph 4 refers to mandatory conditions in \"paragraph 1\", the context does not contain the text of paragraph 1, so the full set of specific cases where a company is strictly mandated to appoint a DPO is not explicitly detailed in the provided text.", "reranked": "Based on the provided context, **no**, not every company is required to appoint a data protection officer (DPO). \n\nUnder **Article 37(1)**, a controller or processor is required to designate a data protection officer only in specific cases where:\n* **(a)** the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;\n* **(b)** the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope, and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or\n* **(c)** the core activities of the controller or the processor consist of processing on a large scale of special categories of data (pursuant to Article 9) and personal data relating to criminal convictions and offences (referred to in Article 10).\n\n**Conditions and Exceptions:**\n* **Voluntary vs. Member State Law:** Under **Article 37(4)**, in cases other than those specified in paragraph 1, controllers, processors, or associations/bodies representing them *may* designate a DPO voluntarily, but they *shall* designate one if required by Union or Member State law.\n* **Groups of Undertakings:** According to **Article 37(2)**, a group of undertakings does not necessarily have to appoint a separate DPO for each company; they may appoint a single data protection officer, provided that the officer is \"easily accessible from each establishment.\""}}, {"category": "exception", "query": "Can data collected for one purpose be used for scientific research later?", "goldSnippets": ["shall, in accordance with article 89(1), not be considered to be incompatible"], "gold": [146], "baselineRank": 9, "rerankedRank": 2, "status": "restored", "candidates": [{"chunk": 125, "page": 29, "cite": "Recital 157", "biRank": 1, "biScore": 0.5408, "ceRank": 7, "ceScore": 0.612, "text": "purposes or statistical purposes is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards exist (such as, for instance, pseudonymisation of the data). Member States should provide for appropriate safeguards for the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Member States should be authorised to provide, under specific conditions and subject to appropriate safeguards for data subjects, specifications and derogations with regard to the information requirements and rights to rectification, to erasure, to be forgotten, to restriction of processing, to data portability, and to object when processing personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. The conditions and safeguards in question may entail specific procedures for data subjects to exercise those rights if this is appropriate in the light of the purposes sought by the specific processing along with technical and organisational measures aimed at minimising the processing of personal data in pursuance of the proportionality and necessity principles. The processing of personal data for scientific purposes should also comply with other relevant legislation such as on clinical trials. (157) By coupling information", "gold": false}, {"chunk": 48, "page": 12, "cite": "Recitals 62–63", "biRank": 2, "biScore": 0.5388, "ceRank": 3, "ceScore": 3.128, "text": "disclosed to another recipient, the data subject should be informed when the personal data are first disclosed to the recipient. Where the controller intends to process the personal data for a purpose other than that for which they were collected, the controller should provide the data subject prior to that further processing with information on that other purpose and other necessary information. Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided. (62) However, it is not necessary to impose the obligation to provide information where the data subject already possesses the information, where the recording or disclosure of the personal data is expressly laid down by law or where the provision of information to the data subject proves to be impossible or would involve a dispropor­ tionate effort. The latter could in particular be the case where processing is carried out for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. In that regard, the number of data subjects, the age of the data and any appropriate safeguards adopted should be taken into consideration. (63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that", "gold": false}, {"chunk": 127, "page": 29, "cite": "Recitals 158–159", "biRank": 3, "biScore": 0.5344, "ceRank": 9, "ceScore": -0.757, "text": "State law. (158) Where personal data are processed for archiving purposes, this Regulation should also apply to that processing, bearing in mind that this Regulation should not apply to deceased persons. Public authorities or public or private bodies that hold records of public interest should be services which, pursuant to Union or Member State law, have a legal obligation to acquire, preserve, appraise, arrange, describe, communicate, promote, disseminate and provide access to records of enduring value for general public interest. Member States should also be authorised to provide for the further processing of personal data for archiving purposes, for example with a view to providing specific information related to the political behaviour under former totalitarian state regimes, genocide, crimes against humanity, in particular the Holocaust, or war crimes. (159) Where personal data are processed for scientific research purposes, this Regulation should also apply to that processing. For the purposes of this Regulation, the processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research. In addition, it should take into account the Union's objective under Article 179(1) TFEU of achieving a European Research Area. Scientific research purposes should also include studies conducted in the public interest in the area of public", "gold": false}, {"chunk": 124, "page": 29, "cite": "Recital 156", "biRank": 4, "biScore": 0.5286, "ceRank": 10, "ceScore": -2.138, "text": "context, in particular for the conditions under which personal data in the employment context may be processed on the basis of the consent of the employee, the purposes of the recruitment, the performance of the contract of employment, including discharge of obligations laid down by law or by collective agreements, management, planning and organisation of work, equality and diversity in the workplace, health and safety at work, and for the purposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to employment, and for the purpose of the termination of the employment relationship. (156) The processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be subject to appropriate safeguards for the rights and freedoms of the data subject pursuant to this Regulation. Those safeguards should ensure that technical and organisational measures are in place in order to ensure, in particular, the principle of data minimisation. The further processing of personal data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is to be carried out when the controller has assessed the feasibility to fulfil those purposes by processing data which do not permit or no longer permit the identification of data subjects, provided that appropriate safeguards", "gold": false}, {"chunk": 297, "page": 84, "cite": "Art. 89", "biRank": 5, "biScore": 0.5276, "ceRank": 4, "ceScore": 2.365, "text": "processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes 1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. 2. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. 3. Where personal data are processed for archiving purposes in the public interest, Union or Member", "gold": false}, {"chunk": 22, "page": 6, "cite": "Recitals 33–35", "biRank": 6, "biScore": 0.5051, "ceRank": 1, "ceScore": 5.999, "text": "and not unnecessarily disruptive to the use of the service for which it is provided. (33) It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose. (34) Genetic data should be defined as personal data relating to the inherited or acquired genetic characteristics of a natural person which result from the analysis of a biological sample from the natural person in question, in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained. (35) Personal data concerning health should include all data pertaining to the health status of a data subject which reveal information relating to the past, current or future physical or mental health status of the data subject. This includes information about the natural person collected in the course of the registration for, or the provision of, health care services as referred to in Directive 2011/24/EU", "gold": false}, {"chunk": 128, "page": 30, "cite": "Recitals 160–162", "biRank": 7, "biScore": 0.5033, "ceRank": 5, "ceScore": 1.64, "text": "privately funded research. In addition, it should take into account the Union's objective under Article 179(1) TFEU of achieving a European Research Area. Scientific research purposes should also include studies conducted in the public interest in the area of public health. To meet the specificities of processing personal data for scientific research purposes, specific conditions should apply in particular as regards the publication or otherwise disclosure of personal data in the context of scientific research purposes. If the result of scientific research in particular in the health context gives reason for further measures in the interest of the data subject, the general rules of this Regulation should apply in view of those measures. (160) Where personal data are processed for historical research purposes, this Regulation should also apply to that processing. This should also include historical research and research for genealogical purposes, bearing in mind that this Regulation should not apply to deceased persons. (161) For the purpose of consenting to the participation in scientific research activities in clinical trials, the relevant provisions of Regulation (EU) No 536/2014 of the European Parliament and of the Council (1) should apply. (162) Where personal data are processed for statistical purposes, this Regulation should apply to that processing. Union or Member State law should, within the limits of this Regulation, determine statistical content,", "gold": false}, {"chunk": 126, "page": 29, "cite": "Recitals 157–158", "biRank": 8, "biScore": 0.4842, "ceRank": 8, "ceScore": 0.26, "text": "aimed at minimising the processing of personal data in pursuance of the proportionality and necessity principles. The processing of personal data for scientific purposes should also comply with other relevant legislation such as on clinical trials. (157) By coupling information from registries, researchers can obtain new knowledge of great value with regard to widespread medical conditions such as cardiovascular disease, cancer and depression. On the basis of registries, research results can be enhanced, as they draw on a larger population. Within social science, research on the basis of registries enables researchers to obtain essential knowledge about the long-term correlation of a number of social conditions such as unemployment and education with other life conditions. Research results obtained through registries provide solid, high-quality knowledge which can provide the basis for the formulation and implementation of knowledge-based policy, improve the quality of life for a number of people and improve the efficiency of social services. In order to facilitate scientific research, personal data can be processed for scientific research purposes, subject to appropriate conditions and safeguards set out in Union or Member State law. (158) Where personal data are processed for archiving purposes, this Regulation should also apply to that processing, bearing in mind that this Regulation should not apply to deceased persons. Public authorities or public or private bodies that hold", "gold": false}, {"chunk": 146, "page": 35, "cite": "Art. 5", "biRank": 9, "biScore": 0.4581, "ceRank": 2, "ceScore": 3.288, "text": "the data subject (‘lawfulness, fairness and transparency’); (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’); (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’); (1) Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services (OJ L 241, 17.9.2015, p. 1). (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific", "gold": true}, {"chunk": 147, "page": 36, "cite": "Arts. 5–6", "biRank": 10, "biScore": 0.442, "ceRank": 6, "ceScore": 1.366, "text": "no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). 2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). Article 6 Lawfulness of processing 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for", "gold": false}], "answers": {"baseline": "Based on the provided context, **yes**, personal data collected for one purpose can be further processed for another purpose, such as scientific research, provided specific rules, safeguards, and conditions are met. \n\n*(Note: The provided passages cite Recitals rather than specific GDPR Articles; citations below reference these passages and recitals).*\n\n### Conditions and Requirements\n* **Information requirements:** Generally, where a controller intends to process personal data for a purpose other than that for which they were collected, the controller must provide the data subject prior to that further processing with information on that other purpose and other necessary information (Passage 2 / Recital 61–62).\n* **Safeguards and data minimization:** Processing for scientific research purposes is to be carried out when the controller has assessed the feasibility of fulfilling those purposes by processing data that do not permit or no longer permit the identification of data subjects, provided appropriate safeguards exist (such as pseudonymisation) (Passage 1).\n* **Proportionality and other legislation:** Technical and organisational measures must be implemented to minimise data processing in pursuance of the proportionality and necessity principles. The processing must also comply with other relevant legislation, such as laws on clinical trials (Passage 1).\n\n### Exceptions\n* **Exception to the obligation to provide information:** It is not necessary to impose the obligation to inform the data subject if:\n  1. The data subject already possesses the information;\n  2. The recording or disclosure of the data is expressly laid down by law; or\n  3. Providing the information proves **impossible or would involve a disproportionate effort**. The context explicitly notes that disproportionate effort *\"could in particular be the case where processing is carried out for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes\"* (taking into account the number of data subjects, the age of the data, and appropriate safeguards) (Passage 2 / Recital 62).\n* **Member State derogations:** Member States are authorized to provide specifications and derogations under specific conditions regarding information requirements and certain data subject rights (rights to rectification, erasure/to be forgotten, restriction of processing, data portability, and to object) when processing for scientific research purposes (Passage 1).", "reranked": "Yes, personal data collected for one purpose can be used for scientific research later. \n\nAccording to the provided context, the following rules, citations, and conditions apply:\n\n* **Compatibility with Initial Purposes:** Under the principle of \"purpose limitation,\" data must not be further processed in a manner incompatible with the initial purposes. However, **\"further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes\"** [Passage 2].\n* **Longer Storage:** Personal data may be kept for longer periods than initially necessary **\"insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific [research purposes]...\"** [Passage 2].\n* **Information Obligations and Exceptions:** \n  * Normally, when a controller intends to process data for a purpose other than that for which it was collected, they must inform the data subject prior to that processing [Passage 3, Recital 62].\n  * However, there is an exception to this obligation if providing the information **\"proves to be impossible or would involve a disproportionate effort,\"** which **\"could in particular be the case where processing is carried out for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.\"** In such cases, the number of data subjects, the age of the data, and any appropriate safeguards adopted must be taken into account [Passage 3, Recital 62].\n* **Consent Conditions:** If consent is relied upon, data subjects should be permitted to give consent to certain areas of scientific research **\"when in keeping with recognised ethical standards for scientific research,\"** and should have the opportunity to limit consent to certain areas or parts of research projects [Passage 1, Recital 33]."}}, {"category": "exception", "query": "Does a controller always have to notify the affected individuals about a data breach?", "goldSnippets": ["shall not be required if any of the following conditions are met"], "gold": [197, 198], "baselineRank": 4, "rerankedRank": 2, "status": "restored", "candidates": [{"chunk": 70, "page": 16, "cite": "Recital 86", "biRank": 1, "biScore": 0.6846, "ceRank": 1, "ceScore": 7.344, "text": "as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay. (86) The controller should communicate to the data subject a personal data breach, without undue delay, where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person in order to allow him or her to take the necessary precautions. The communication should describe the nature of the personal data breach as well as recommendations for the natural person concerned to mitigate potential adverse effects. Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the supervisory authority, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities. For example, the need to", "gold": false}, {"chunk": 196, "page": 52, "cite": "Art. 33", "biRank": 2, "biScore": 0.6329, "ceRank": 3, "ceScore": 5.389, "text": "than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay. 2. The processor shall notify the controller without undue delay after becoming aware of a personal data breach. 3. The notification referred to in paragraph 1 shall at least: (a) describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (b) communicate the name and contact details of the data protection officer or other contact point where more information can be obtained; (c) describe the likely consequences of the personal data breach; (d) describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. 4. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay. 5. The", "gold": false}, {"chunk": 69, "page": 16, "cite": "Recital 85", "biRank": 3, "biScore": 0.6136, "ceRank": 4, "ceScore": 4.4, "text": "persons, the controller should be responsible for the carrying-out of a data protection impact assessment to evaluate, in particular, the origin, nature, particularity and severity of that risk. The outcome of the assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the processing of personal data complies with this Regulation. Where a data-protection impact assessment indicates that processing operations involve a high risk which the controller cannot mitigate by appropriate measures in terms of available technology and costs of implementation, a consultation of the supervisory authority should take place prior to the processing. (85) A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become", "gold": false}, {"chunk": 197, "page": 52, "cite": "Arts. 33–34", "biRank": 4, "biScore": 0.5781, "ceRank": 5, "ceScore": 4.261, "text": "appropriate, measures to mitigate its possible adverse effects. 4. Where, and in so far as, it is not possible to provide the information at the same time, the information may be provided in phases without undue further delay. 5. The controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify compliance with this Article. Article 34 Communication of a personal data breach to the data subject 1. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay. 2. The communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to in points (b), (c) and (d) of Article 33(3). 3. The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met: (a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the", "gold": true}, {"chunk": 71, "page": 17, "cite": "Recitals 87–88", "biRank": 5, "biScore": 0.5649, "ceRank": 9, "ceScore": -0.181, "text": "Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the supervisory authority, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities. For example, the need to mitigate an immediate risk of damage would call for prompt communication with data subjects whereas the need to implement appropriate measures against continuing or similar personal data breaches may justify more time for communication. (87) It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place and to inform promptly the supervisory authority and the data subject. The fact that the notification was made without undue delay should be established taking into account in particular the nature and gravity of the personal data breach and its consequences and adverse effects for the data subject. Such notification may result in an intervention of the supervisory authority in accordance with its tasks and powers laid down in this Regulation. (88) In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, including whether or not personal data had been protected by appropriate technical protection measures, effectively limiting the likelihood of", "gold": false}, {"chunk": 195, "page": 52, "cite": "Arts. 32–33", "biRank": 6, "biScore": 0.56, "ceRank": 8, "ceScore": 1.508, "text": "the processing. 2. In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. 3. Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article. 4. The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law. Article 33 Notification of a personal data breach to the supervisory authority 1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and", "gold": false}, {"chunk": 72, "page": 17, "cite": "Recital 89", "biRank": 7, "biScore": 0.5296, "ceRank": 6, "ceScore": 3.05, "text": "and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, including whether or not personal data had been protected by appropriate technical protection measures, effectively limiting the likelihood of identity fraud or other forms of misuse. Moreover, such rules and procedures should take into account the legitimate interests of law-enforcement authorities where early disclosure could unnecessarily hamper the investi­ gation of the circumstances of a personal data breach. (89) Directive 95/46/EC provided for a general obligation to notify the processing of personal data to the supervisory authorities. While that obligation produces administrative and financial burdens, it did not in all cases contribute to improving the protection of personal data. Such indiscriminate general notification obligations should therefore be abolished, and replaced by effective procedures and mechanisms which focus instead on those types of processing operations which are likely to result in a high risk to the rights and freedoms of natural persons by virtue of their nature, scope, context and purposes. Such types of processing operations may be those which in, particular, involve using new technologies, or are of a new kind and where no data protection impact assessment has been carried out before by the controller, or where they become necessary in the light of the time that has", "gold": false}, {"chunk": 198, "page": 53, "cite": "Arts. 34–35", "biRank": 8, "biScore": 0.4947, "ceRank": 2, "ceScore": 5.547, "text": "referred to in paragraph 1 shall not be required if any of the following conditions are met: (a) the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; (b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise; (c) it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner. 4. If the controller has not already communicated the personal data breach to the data subject, the supervisory authority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to in paragraph 3 are met. Section 3 Data protection impact assessment and prior consultation Article 35 Data protection impact assessment 1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the", "gold": true}, {"chunk": 50, "page": 12, "cite": "Recitals 64–65", "biRank": 9, "biScore": 0.464, "ceRank": 7, "ceScore": 1.885, "text": "would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates. (64) The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests. (65) A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer", "gold": false}, {"chunk": 175, "page": 44, "cite": "Arts. 18–20", "biRank": 10, "biScore": 0.4524, "ceRank": 10, "ceScore": -0.37, "text": "legal person or for reasons of important public interest of the Union or of a Member State. 3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted. Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. Article 20 Right to data portability 1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: (a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and (b) the", "gold": false}], "answers": {"baseline": "Based on the provided context, **no**, a controller does not always have to notify affected individuals (data subjects) about a personal data breach. \n\nAccording to **Recital (86)** (Passage 1), notification is subject to specific conditions:\n\n* **Condition for notification:** The controller is required to communicate the breach to the data subject only **\"where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person\"** in order to allow them to take necessary precautions. \n* **Timing and cooperation:** When required, the communication must be made \"without undue delay,\" \"as soon as reasonably feasible,\" and \"in close cooperation with the supervisory authority.\"\n* **Content:** The notification must describe the nature of the personal data breach and provide recommendations for the individual to mitigate potential adverse effects.\n\n*(Note: The provided context does not cite the specific Article number governing communication to data subjects, only Recital (86); Article 55 is mentioned in Passage 2 solely in relation to the competent supervisory authority).*", "reranked": "Based on the provided context, **no**, a controller does not always have to notify affected individuals (data subjects) about a personal data breach. \n\nFirst, communication to the data subject is only required **\"where that personal data breach is likely to result in a high risk to the rights and freedoms of the natural person\"** ([Passage 1 | chunk 70]).\n\nSecond, even in high-risk cases, communication to the data subject is **not required** if any of the following conditions/exceptions are met ([Passage 2 | chunk 198]):\n\n1. **Appropriate protection measures were applied:** The controller implemented appropriate technical and organisational protection measures to the affected data, particularly measures rendering the data unintelligible to unauthorised persons, such as encryption (Condition a).\n2. **Subsequent mitigating measures:** The controller took subsequent measures ensuring that the high risk to the rights and freedoms of data subjects is no longer likely to materialise (Condition b).\n3. **Disproportionate effort:** Direct communication would involve disproportionate effort. In such a case, there must instead be a public communication or similar measure that informs the data subjects in an equally effective manner (Condition c).\n\n*(Note: The supervisory authority may still require the controller to communicate the breach after considering the likelihood of high risk, or it may decide that any of the above conditions are met [Passage 2 | chunk 198]).*"}}, {"category": "exception", "query": "Can a company refuse a person's request to have their data erased?", "goldSnippets": ["paragraphs 1 and 2 shall not apply to the extent that processing is necessary"], "gold": [172, 173], "baselineRank": 3, "rerankedRank": 3, "status": "both-hit", "candidates": [{"chunk": 171, "page": 43, "cite": "Arts. 15–17", "biRank": 1, "biScore": 0.7115, "ceRank": 4, "ceScore": -3.818, "text": "by the data subject, the information shall be provided in a commonly used electronic form. 4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Section 3 Rectification and erasure Article 16 Right to rectification The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Article 17 Right to erasure (‘right to be forgotten’) 1. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the", "gold": false}, {"chunk": 50, "page": 12, "cite": "Recitals 64–65", "biRank": 2, "biScore": 0.6552, "ceRank": 2, "ceScore": 1.524, "text": "would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates. (64) The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests. (65) A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer", "gold": false}, {"chunk": 172, "page": 44, "cite": "Art. 17", "biRank": 3, "biScore": 0.6407, "ceRank": 3, "ceScore": -2.083, "text": "subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; (c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); (d) the personal data have been unlawfully processed; (e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; (f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). 2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. 3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and", "gold": true}, {"chunk": 170, "page": 43, "cite": "Art. 15", "biRank": 4, "biScore": 0.6052, "ceRank": 8, "ceScore": -5.973, "text": "rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. 3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. 4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Section 3 Rectification", "gold": false}, {"chunk": 52, "page": 13, "cite": "Recitals 66–67", "biRank": 5, "biScore": 0.6038, "ceRank": 5, "ceScore": -4.834, "text": "expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims. (66) To strengthen the right to be forgotten in the online environment, the right to erasure should also be extended in such a way that a controller who has made the personal data public should be obliged to inform the controllers which are processing such personal data to erase any links to, or copies or replications of those personal data. In doing so, that controller should take reasonable steps, taking into account available technology and the means available to the controller, including technical measures, to inform the controllers which are processing the personal data of the data subject's request. (67) Methods by which to restrict the processing of personal data could include, inter alia, temporarily moving the selected data to another processing system, making the selected personal data unavailable to users, or temporarily removing published data from a website. In automated filing systems, the restriction of processing should in principle be", "gold": false}, {"chunk": 175, "page": 44, "cite": "Arts. 18–20", "biRank": 6, "biScore": 0.5958, "ceRank": 6, "ceScore": -4.975, "text": "legal person or for reasons of important public interest of the Union or of a Member State. 3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted. Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. Article 20 Right to data portability 1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: (a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and (b) the", "gold": false}, {"chunk": 147, "page": 36, "cite": "Arts. 5–6", "biRank": 7, "biScore": 0.5859, "ceRank": 10, "ceScore": -9.269, "text": "no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). 2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). Article 6 Lawfulness of processing 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for", "gold": false}, {"chunk": 55, "page": 13, "cite": "Recitals 69–70", "biRank": 8, "biScore": 0.5847, "ceRank": 9, "ceScore": -6.982, "text": "data subject to obtain the erasure of personal data and the limitations of that right as set out in this Regulation and should, in particular, not imply the erasure of personal data concerning the data subject which have been provided by him or her for the performance of a contract to the extent that and for as long as the personal data are necessary for the performance of that contract. Where technically feasible, the data subject should have the right to have the personal data transmitted directly from one controller to another. (69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject. (70) Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that", "gold": false}, {"chunk": 28, "page": 7, "cite": "Recital 40", "biRank": 9, "biScore": 0.5708, "ceRank": 7, "ceScore": -5.19, "text": "for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing. (40) In order for processing to be lawful, personal data should be processed on the basis of the consent of the data subject concerned or some other legitimate basis, laid down by law, either in this Regulation or in other Union or Member State law as referred to in this Regulation, including the necessity for compliance with the legal obligation to which the controller is subject or the necessity for the performance of a contract to which the data subject is party or in order to take steps at the request", "gold": false}, {"chunk": 51, "page": 12, "cite": "Recitals", "biRank": 10, "biScore": 0.5689, "ceRank": 1, "ceScore": 1.531, "text": "or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the", "gold": false}]}, {"category": "negation", "query": "Is processing someone's religious beliefs or health information prohibited?", "goldSnippets": ["shall be prohibited"], "gold": [153], "baselineRank": 10, "rerankedRank": 2, "status": "restored", "candidates": [{"chunk": 299, "page": 85, "cite": "Arts. 90–91", "biRank": 1, "biScore": 0.5137, "ceRank": 9, "ceScore": -7.136, "text": "Member State law or rules established by national competent bodies, to an obligation of professional secrecy or other equivalent obligations of secrecy where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy. Those rules shall apply only with regard to personal data which the controller or processor has received as a result of or has obtained in an activity covered by that obligation of secrecy. 2. Each Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. Article 91 Existing data protection rules of churches and religious associations 1. Where in a Member State, churches and religious associations or communities apply, at the time of entry into force of this Regulation, comprehensive rules relating to the protection of natural persons with regard to processing, such rules may continue to apply, provided that they are brought into line with this Regulation. 2. Churches and religious associations which apply comprehensive rules in accordance with paragraph 1 of this Article shall be subject to the supervision of an independent supervisory authority, which may be specific, provided that it fulfils the conditions laid down in Chapter VI of this Regulation. CHAPTER X Delegated acts and implementing acts", "gold": false}, {"chunk": 44, "page": 11, "cite": "Recitals 55–57", "biRank": 2, "biScore": 0.4995, "ceRank": 3, "ceScore": -1.573, "text": "result in personal data being processed for other purposes by third parties such as employers or insurance and banking companies. (55) Moreover, the processing of personal data by official authorities for the purpose of achieving the aims, laid down by constitutional law or by international public law, of officially recognised religious associations, is carried out on grounds of public interest. (56) Where in the course of electoral activities, the operation of the democratic system in a Member State requires that political parties compile personal data on people's political opinions, the processing of such data may be permitted for reasons of public interest, provided that appropriate safeguards are established. (57) If the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. (58)", "gold": false}, {"chunk": 40, "page": 10, "cite": "Recital 52", "biRank": 3, "biScore": 0.4963, "ceRank": 4, "ceScore": -1.864, "text": "for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. In addition to the specific requirements for such processing, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for lawful processing. Derogations from the general prohibition for processing such special categories of personal data should be explicitly provided, inter alia, where the data subject gives his or her explicit consent or in respect of specific needs in particular where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms. (52) Derogating from the prohibition on processing special categories of personal data should also be allowed when provided for in Union or Member State law and subject to suitable safeguards, so as to protect personal data and other fundamental rights, where it is in the public interest to do so, in particular processing personal data in the field of employment law, social protection law including pensions and for health security, monitoring and alert purposes, the prevention or control of communicable diseases and other serious threats to health. Such a derogation may be made for health", "gold": false}, {"chunk": 49, "page": 12, "cite": "Recital 63", "biRank": 4, "biScore": 0.4916, "ceRank": 7, "ceScore": -4.261, "text": "the age of the data and any appropriate safeguards adopted should be taken into consideration. (63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software.", "gold": false}, {"chunk": 173, "page": 44, "cite": "Arts. 17–18", "biRank": 5, "biScore": 0.4771, "ceRank": 8, "ceScore": -5.887, "text": "by such controllers of any links to, or copy or replication of, those personal data. 3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3); (d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or (e) for the establishment, exercise or defence of legal claims. Article 18 Right to restriction of processing 1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: (a) the accuracy of the personal data is contested by the data subject, for a period enabling the", "gold": false}, {"chunk": 154, "page": 38, "cite": "Art. 9", "biRank": 6, "biScore": 0.47, "ceRank": 5, "ceScore": -2.421, "text": "(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; (b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject; (c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not", "gold": false}, {"chunk": 151, "page": 37, "cite": "Arts. 6–7", "biRank": 7, "biScore": 0.4679, "ceRank": 10, "ceScore": -7.595, "text": "processing; (b) the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller; (c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10; (d) the possible consequences of the intended further processing for data subjects; (e) the existence of appropriate safeguards, which may include encryption or pseudonymisation. Article 7 Conditions for consent 1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. 2. If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to", "gold": false}, {"chunk": 61, "page": 15, "cite": "Recital 76", "biRank": 8, "biScore": 0.4678, "ceRank": 1, "ceScore": -0.067, "text": "natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial loss, damage to the reputation, loss of confidentiality of personal data protected by professional secrecy, unauthorised reversal of pseudonymisation, or any other significant economic or social disadvantage; where data subjects might be deprived of their rights and freedoms or prevented from exercising control over their personal data; where personal data are processed which reveal racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, and the processing of genetic data, data concerning health or data concerning sex life or criminal convictions and offences or related security measures; where personal aspects are evaluated, in particular analysing or predicting aspects concerning performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, in order to create or use personal profiles; where personal data of vulnerable natural persons, in particular of children, are processed; or where processing involves a large amount of personal data and affects a large number of data subjects. (76) The likelihood and severity of the risk to the rights and freedoms of the data subject should be determined by reference to the nature, scope,", "gold": false}, {"chunk": 156, "page": 38, "cite": "Art. 9", "biRank": 9, "biScore": 0.4674, "ceRank": 6, "ceScore": -4.193, "text": "health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; (i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy; (j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be propor­ tionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. 3. Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union", "gold": false}, {"chunk": 153, "page": 37, "cite": "Arts. 8–9", "biRank": 10, "biScore": 0.4667, "ceRank": 2, "ceScore": -0.198, "text": "and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years. 2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. 3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child. Article 9 Processing of special categories of personal data 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. 2. Paragraph 1 shall not apply if one of the following applies: (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be", "gold": true}], "answers": {"baseline": "Based on the provided context, the passages do not explicitly define or list \"religious beliefs\" or \"health information\" as prohibited categories. Therefore, the context does not explicitly state that processing these specific items is prohibited. \n\nHowever, the context does reference a **\"general prohibition for processing such special categories of personal data\"** [Passage 3, Recital (51)–(52)] and outlines several derogations, exceptions, and conditions that relate to health and religious bodies:\n\n### Exceptions and Conditions Regarding Health\nAccording to Passage 3 [Recital (52)], derogations from the prohibition on processing special categories of personal data are allowed:\n*   When provided for in Union or Member State law and subject to suitable safeguards.\n*   Where it is in the public interest, specifically:\n    *   *\"in particular processing personal data in the field of employment law, social protection law including pensions and for health security, monitoring and alert purposes, the prevention or control of communicable diseases and other serious threats to health.\"*\n    *   *\"Such a derogation may be made for health...\"*\n\n### Exceptions and Conditions Regarding Religion\nThe passages address religious processing under specific conditions:\n*   **Fundamental freedoms / associations:** A derogation applies where the data subject gives explicit consent, or *\"where the processing is carried out in the course of legitimate activities by certain associations or foundations the purpose of which is to permit the exercise of fundamental freedoms\"* [Passage 3, Recital (51)].\n*   **Official authorities:** The processing of personal data by official authorities to achieve the aims of officially recognised religious associations (laid down by constitutional or international public law) *\"is carried out on grounds of public interest\"* [Passage 2, Recital (55)].\n*   **Rules of churches and religious associations (Article 91):** \n    *   Under **Article 91(1)**, existing comprehensive rules applied by churches and religious associations/communities relating to the protection of natural persons with regard to processing *\"may continue to apply, provided that they are brought into line with this Regulation.\"*\n    *   Under **Article 91(2)**, they *\"shall be subject to the supervision of an independent supervisory authority, which may be specific, provided that it fulfils the conditions laid down in", "reranked": "Yes. Under **Article 9(1)** of the GDPR, the processing of personal data revealing **religious or philosophical beliefs** and the processing of **data concerning health** is generally **prohibited**.\n\nHowever, this prohibition does not apply if certain exceptions are met under **Article 9(2)**:\n* **Explicit consent:** Under Article 9(2)(a), processing is permitted if *\"the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be\"* lifted by the data subject.\n\nAdditionally, the context notes related conditions/grounds:\n* **Official religious associations:** Recital (55) mentions that *\"the processing of personal data by official authorities for the purpose of achieving the aims, laid down by constitutional law or by international public law, of officially recognised religious associations, is carried out on grounds of public interest.\"*"}}, {"category": "negation", "query": "Can the data protection officer be fired for doing their job?", "goldSnippets": ["shall not be dismissed or penalised"], "gold": [207], "baselineRank": 1, "rerankedRank": 1, "status": "both-hit", "candidates": [{"chunk": 207, "page": 55, "cite": "Arts. 37–38", "biRank": 1, "biScore": 0.536, "ceRank": 1, "ceScore": 1.955, "text": "Article 38 Position of the data protection officer 1. The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data. 2. The controller and processor shall support the data protection officer in performing the tasks referred to in Article 39 by providing resources necessary to carry out those tasks and access to personal data and processing operations, and to maintain his or her expert knowledge. 3. The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks. The data protection officer shall directly report to the highest management level of the controller or the processor. 4. Data subjects may contact the data protection officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation. 5. The data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law. 6. The data protection officer may fulfil other tasks and duties. The controller or processor shall", "gold": true}, {"chunk": 208, "page": 56, "cite": "Arts. 38–39", "biRank": 2, "biScore": 0.527, "ceRank": 2, "ceScore": 1.153, "text": "officer shall be bound by secrecy or confidentiality concerning the performance of his or her tasks, in accordance with Union or Member State law. 6. The data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such tasks and duties do not result in a conflict of interests. Article 39 Tasks of the data protection officer 1. The data protection officer shall have at least the following tasks: (a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions; (b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits; (c) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35; (d) to cooperate with the supervisory authority; (e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard", "gold": false}, {"chunk": 206, "page": 55, "cite": "Arts. 37–38", "biRank": 3, "biScore": 0.4947, "ceRank": 3, "ceScore": -0.335, "text": "establishment. 3. Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size. 4. In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer. The data protection officer may act for such associations and other bodies representing controllers or processors. 5. The data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39. 6. The data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of a service contract. 7. The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority. Article 38 Position of the data protection officer 1. The controller and the processor shall ensure that the data protection officer is involved, properly and in a timely manner, in all issues which relate to the protection of personal data.", "gold": false}, {"chunk": 195, "page": 52, "cite": "Arts. 32–33", "biRank": 4, "biScore": 0.4709, "ceRank": 10, "ceScore": -9.709, "text": "the processing. 2. In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed. 3. Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1 of this Article. 4. The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law. Article 33 Notification of a personal data breach to the supervisory authority 1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and", "gold": false}, {"chunk": 231, "page": 63, "cite": "Art. 47", "biRank": 5, "biScore": 0.4525, "ceRank": 6, "ceScore": -5.291, "text": "of personal data, measures to ensure data security, and the requirements in respect of onward transfers to bodies not bound by the binding corporate rules; (e) the rights of data subjects in regard to processing and the means to exercise those rights, including the right not to be subject to decisions based solely on automated processing, including profiling in accordance with Article 22, the right to lodge a complaint with the competent supervisory authority and before the competent courts of the Member States in accordance with Article 79, and to obtain redress and, where appropriate, compensation for a breach of the binding corporate rules; (f) the acceptance by the controller or processor established on the territory of a Member State of liability for any breaches of the binding corporate rules by any member concerned not established in the Union; the controller or the processor shall be exempt from that liability, in whole or in part, only if it proves that that member is not responsible for the event giving rise to the damage; (g) how the information on the binding corporate rules, in particular on the provisions referred to in points (d), (e) and (f) of this paragraph is provided to the data subjects in addition to Articles 13 and 14; (h) the tasks of any data protection officer designated", "gold": false}, {"chunk": 69, "page": 16, "cite": "Recital 85", "biRank": 6, "biScore": 0.4507, "ceRank": 5, "ceScore": -4.046, "text": "persons, the controller should be responsible for the carrying-out of a data protection impact assessment to evaluate, in particular, the origin, nature, particularity and severity of that risk. The outcome of the assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the processing of personal data complies with this Regulation. Where a data-protection impact assessment indicates that processing operations involve a high risk which the controller cannot mitigate by appropriate measures in terms of available technology and costs of implementation, a consultation of the supervisory authority should take place prior to the processing. (85) A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become", "gold": false}, {"chunk": 205, "page": 55, "cite": "Arts. 36–37", "biRank": 7, "biScore": 0.4464, "ceRank": 4, "ceScore": -1.681, "text": "processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health. Section 4 Data protection off icer Article 37 Designation of the data protection officer 1. The controller and the processor shall designate a data protection officer in any case where: (a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; (b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or (c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10. 2. A group of undertakings may appoint a single data protection officer provided that a data protection officer is easily accessible from each establishment. 3. Where the controller or the processor is a public authority or body, a single data protection officer may be designated for several such authorities or bodies, taking account of their organisational structure and size. 4. In cases other", "gold": false}, {"chunk": 247, "page": 68, "cite": "Art. 57", "biRank": 8, "biScore": 0.4379, "ceRank": 8, "ceScore": -7.358, "text": "inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary; (g) cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation; (h) conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority; (i) monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices; (j) adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2); (k) establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4); (l) give advice on the processing operations referred to in Article 36(2); (m) encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5); (n) encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5); (o)", "gold": false}, {"chunk": 134, "page": 31, "cite": "Recitals 171–173", "biRank": 9, "biScore": 0.4368, "ceRank": 9, "ceScore": -9.481, "text": "that Article, this Regulation does not go beyond what is necessary in order to achieve that objective. (171) Directive 95/46/EC should be repealed by this Regulation. Processing already under way on the date of application of this Regulation should be brought into conformity with this Regulation within the period of two years after which this Regulation enters into force. Where processing is based on consent pursuant to Directive 95/46/EC, it is not necessary for the data subject to give his or her consent again if the manner in which the consent has been given is in line with the conditions of this Regulation, so as to allow the controller to continue such processing after the date of application of this Regulation. Commission decisions adopted and authorisations by supervisory authorities based on Directive 95/46/EC remain in force until amended, replaced or repealed. (172) The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 and delivered an opinion on 7 March 2012 (1). (173) This Regulation should apply to all matters concerning the protection of fundamental rights and freedoms vis-àvis the processing of personal data which are not subject to specific obligations with the same objective set out in Directive 2002/58/EC of the European Parliament and of the Council (2), including the obligations on the", "gold": false}, {"chunk": 71, "page": 17, "cite": "Recitals 87–88", "biRank": 10, "biScore": 0.4366, "ceRank": 7, "ceScore": -6.329, "text": "Such communications to data subjects should be made as soon as reasonably feasible and in close cooperation with the supervisory authority, respecting guidance provided by it or by other relevant authorities such as law-enforcement authorities. For example, the need to mitigate an immediate risk of damage would call for prompt communication with data subjects whereas the need to implement appropriate measures against continuing or similar personal data breaches may justify more time for communication. (87) It should be ascertained whether all appropriate technological protection and organisational measures have been implemented to establish immediately whether a personal data breach has taken place and to inform promptly the supervisory authority and the data subject. The fact that the notification was made without undue delay should be established taking into account in particular the nature and gravity of the personal data breach and its consequences and adverse effects for the data subject. Such notification may result in an intervention of the supervisory authority in accordance with its tasks and powers laid down in this Regulation. (88) In setting detailed rules concerning the format and procedures applicable to the notification of personal data breaches, due consideration should be given to the circumstances of that breach, including whether or not personal data had been protected by appropriate technical protection measures, effectively limiting the likelihood of", "gold": false}]}, {"category": "negation", "query": "In which cases does the right to data portability not apply?", "goldSnippets": ["that right shall not apply to processing necessary for the performance of a task"], "gold": [176], "baselineRank": 3, "rerankedRank": 1, "status": "both-hit", "candidates": [{"chunk": 175, "page": 44, "cite": "Arts. 18–20", "biRank": 1, "biScore": 0.5977, "ceRank": 5, "ceScore": 0.712, "text": "legal person or for reasons of important public interest of the Union or of a Member State. 3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted. Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. Article 20 Right to data portability 1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: (a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and (b) the", "gold": false}, {"chunk": 147, "page": 36, "cite": "Arts. 5–6", "biRank": 2, "biScore": 0.5738, "ceRank": 10, "ceScore": -7.873, "text": "no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). 2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’). Article 6 Lawfulness of processing 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (c) processing is necessary for", "gold": false}, {"chunk": 176, "page": 45, "cite": "Arts. 20–21", "biRank": 3, "biScore": 0.5692, "ceRank": 1, "ceScore": 4.438, "text": "personal data have been provided, where: (a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and (b) the processing is carried out by automated means. 2. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible. 3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others. Section 4 Right to object and automated individual decision-making Article 21 Right to object 1. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer", "gold": true}, {"chunk": 179, "page": 46, "cite": "Arts. 22–23", "biRank": 4, "biScore": 0.5647, "ceRank": 8, "ceScore": -3.204, "text": "(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent. 3. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. 4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place. Section 5 Restrictions Article 23 Restrictions 1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22,", "gold": false}, {"chunk": 53, "page": 13, "cite": "Recital 68", "biRank": 5, "biScore": 0.5588, "ceRank": 2, "ceScore": 2.09, "text": "include, inter alia, temporarily moving the selected data to another processing system, making the selected personal data unavailable to users, or temporarily removing published data from a website. In automated filing systems, the restriction of processing should in principle be ensured by technical means in such a manner that the personal data are not subject to further processing operations and cannot be changed. The fact that the processing of personal data is restricted should be clearly indicated in the system. (68) To further strengthen the control over his or her own data, where the processing of personal data is carried out by automated means, the data subject should also be allowed to receive personal data concerning him or her which he or she has provided to a controller in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another controller. Data controllers should be encouraged to develop interoperable formats that enable data portability. That right should apply where the data subject provided the personal data on the basis of his or her consent or the processing is necessary for the performance of a contract. It should not apply where processing is based on a legal ground other than consent or contract. By its very nature, that right should not be exercised against controllers processing personal data", "gold": false}, {"chunk": 54, "page": 13, "cite": "Recitals", "biRank": 6, "biScore": 0.5443, "ceRank": 3, "ceScore": 1.988, "text": "is necessary for the performance of a contract. It should not apply where processing is based on a legal ground other than consent or contract. By its very nature, that right should not be exercised against controllers processing personal data in the exercise of their public duties. It should therefore not apply where the processing of the personal data is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller. The data subject's right to transmit or receive personal data concerning him or her should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible. Where, in a certain set of personal data, more than one data subject is concerned, the right to receive the personal data should be without prejudice to the rights and freedoms of other data subjects in accordance with this Regulation. Furthermore, that right should not prejudice the right of the data subject to obtain the erasure of personal data and the limitations of that right as set out in this Regulation and should, in particular, not imply the erasure of personal data concerning the data subject which have been provided", "gold": false}, {"chunk": 55, "page": 13, "cite": "Recitals 69–70", "biRank": 7, "biScore": 0.539, "ceRank": 9, "ceScore": -3.283, "text": "data subject to obtain the erasure of personal data and the limitations of that right as set out in this Regulation and should, in particular, not imply the erasure of personal data concerning the data subject which have been provided by him or her for the performance of a contract to the extent that and for as long as the personal data are necessary for the performance of that contract. Where technically feasible, the data subject should have the right to have the personal data transmitted directly from one controller to another. (69) Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject. (70) Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that", "gold": false}, {"chunk": 163, "page": 41, "cite": "Art. 13", "biRank": 8, "biScore": 0.5367, "ceRank": 4, "ceScore": 1.388, "text": "country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available. 2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability; (c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (d) the right to lodge a complaint with a supervisory authority; (e) whether the provision", "gold": false}, {"chunk": 49, "page": 12, "cite": "Recital 63", "biRank": 9, "biScore": 0.5353, "ceRank": 7, "ceScore": -2.558, "text": "the age of the data and any appropriate safeguards adopted should be taken into consideration. (63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software.", "gold": false}, {"chunk": 91, "page": 21, "cite": "Recitals 114–115", "biRank": 10, "biScore": 0.5296, "ceRank": 6, "ceScore": -1.937, "text": "the country of final destination, and should provide suitable safeguards to protect fundamental rights and freedoms of natural persons with regard to the processing of their personal data. Such transfers should be possible only in residual cases where none of the other grounds for transfer are applicable. For scientific or historical research purposes or statistical purposes, the legitimate expectations of society for an increase of knowledge should be taken into con­ sideration. The controller should inform the supervisory authority and the data subject about the transfer. (114) In any case, where the Commission has taken no decision on the adequate level of data protection in a third country, the controller or processor should make use of solutions that provide data subjects with enforceable and effective rights as regards the processing of their data in the Union once those data have been transferred so that that they will continue to benefit from fundamental rights and safeguards. (115) Some third countries adopt laws, regulations and other legal acts which purport to directly regulate the processing activities of natural and legal persons under the jurisdiction of the Member States. This may include judgments of courts or tribunals or decisions of administrative authorities in third countries requiring a controller or processor to transfer or disclose personal data, and which are not based on an", "gold": false}]}, {"category": "buried", "query": "What is the maximum fine for breaching the basic principles of processing?", "goldSnippets": ["20 000 000 eur"], "gold": [291, 292], "baselineRank": 7, "rerankedRank": 1, "status": "restored", "candidates": [{"chunk": 290, "page": 82, "cite": "Art. 83", "biRank": 1, "biScore": 0.6233, "ceRank": 3, "ceScore": -3.835, "text": "to what extent, the controller or processor notified the infringement; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; (j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement. 3. If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement. 4. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43; (b) the obligations of the certification body pursuant to Articles 42 and 43; (c) the obligations of the monitoring body pursuant to Article 41(4). 5. Infringements", "gold": false}, {"chunk": 117, "page": 27, "cite": "Recital 149", "biRank": 2, "biScore": 0.5673, "ceRank": 6, "ceScore": -6.144, "text": "of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine. Due regard should however be given to the nature, gravity and duration of the infringement, the intentional character of the infringement, actions taken to mitigate the damage suffered, degree of responsibility or any relevant previous infringements, the manner in which the infringement became known to the supervisory authority, compliance with measures ordered against the controller or processor, adherence to a code of conduct and any other aggravating or mitigating factor. The imposition of penalties including administrative fines should be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter, including effective judicial protection and due process. (149) Member States should be able to lay down the rules on criminal penalties for infringements of this Regulation, including for infringements of national rules adopted pursuant to and within the limits of this Regulation. Those criminal penalties may also allow for the deprivation of the profits obtained through infringements of this Regulation. However, the imposition of criminal penalties for infringements of such national rules and of administrative penalties should not lead to a breach of the principle of ne bis in idem, as interpreted by the", "gold": false}, {"chunk": 289, "page": 82, "cite": "Art. 83", "biRank": 3, "biScore": 0.5602, "ceRank": 2, "ceScore": -3.568, "text": "whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: (a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; (b) the intentional or negligent character of the infringement; (c) any action taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32; (e) any relevant previous infringements by the controller or processor; (f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; (g) the categories of personal data affected by the infringement; (h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; (j) adherence", "gold": false}, {"chunk": 120, "page": 28, "cite": "Recitals 152–153", "biRank": 4, "biScore": 0.5531, "ceRank": 10, "ceScore": -9.301, "text": "fine is imposed by competent national courts as a criminal penalty and in Estonia the fine is imposed by the supervisory authority in the framework of a misdemeanour procedure, provided that such an application of the rules in those Member States has an equivalent effect to administrative fines imposed by supervisory authorities. Therefore the competent national courts should take into account the recommendation by the supervisory authority initiating the fine. In any event, the fines imposed should be effective, proportionate and dissuasive. (152) Where this Regulation does not harmonise administrative penalties or where necessary in other cases, for example in cases of serious infringements of this Regulation, Member States should implement a system which provides for effective, proportionate and dissuasive penalties. The nature of such penalties, criminal or adminis­ trative, should be determined by Member State law. (153) Member States law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic and or literary expression with the right to the protection of personal data pursuant to this Regulation. The processing of personal data solely for journalistic purposes, or for the purposes of academic, artistic or literary expression should be subject to derogations or exemptions from certain provisions of this Regulation if necessary to reconcile the right to the protection of personal data with the right to", "gold": false}, {"chunk": 293, "page": 83, "cite": "Arts. 83–85", "biRank": 5, "biScore": 0.5433, "ceRank": 9, "ceScore": -8.544, "text": "imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the administrative fines imposed by supervisory authorities. In any event, the fines imposed shall be effective, proportionate and dissuasive. Those Member States shall notify to the Commission the provisions of their laws which they adopt pursuant to this paragraph by 25 May 2018 and, without delay, any subsequent amendment law or amendment affecting them. Article 84 Penalties 1. Member States shall lay down the rules on other penalties applicable to infringements of this Regulation in particular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all measures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive. 2. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them. CHAPTER IX Provisions relating to specific processing situations Article 85 Processing and freedom of expression and information 1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and the purposes of academic, artistic or literary expression.", "gold": false}, {"chunk": 288, "page": 81, "cite": "Arts. 82–83", "biRank": 6, "biScore": 0.5351, "ceRank": 7, "ceScore": -6.288, "text": "the data subject. 5. Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2. 6. Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2). Article 83 General conditions for imposing administrative fines 1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. 2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: (a) the nature, gravity and duration of the infringement taking into account the", "gold": false}, {"chunk": 291, "page": 82, "cite": "Art. 83", "biRank": 7, "biScore": 0.5233, "ceRank": 1, "ceScore": 1.505, "text": "the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43; (b) the obligations of the certification body pursuant to Articles 42 and 43; (c) the obligations of the monitoring body pursuant to Article 41(4). 5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9; (b) the data subjects' rights pursuant to Articles 12 to 22; (c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; (d) any obligations pursuant to Member State law adopted under Chapter IX; (e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1). 6. Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000", "gold": true}, {"chunk": 116, "page": 27, "cite": "Recitals 147–148", "biRank": 8, "biScore": 0.5213, "ceRank": 5, "ceScore": -6.067, "text": "entire damage. However, where they are joined to the same judicial proceedings, in accordance with Member State law, compensation may be apportioned according to the responsibility of each controller or processor for the damage caused by the processing, provided that full and effective compensation of the data subject who suffered the damage is ensured. Any controller or processor which has paid full compensation may subsequently institute recourse proceedings against other controllers or processors involved in the same processing. (147) Where specific rules on jurisdiction are contained in this Regulation, in particular as regards proceedings seeking a judicial remedy including compensation, against a controller or processor, general jurisdiction rules such as those of Regulation (EU) No 1215/2012 of the European Parliament and of the Council (1) should not prejudice the application of such specific rules. (148) In order to strengthen the enforcement of the rules of this Regulation, penalties including administrative fines should be imposed for any infringement of this Regulation, in addition to, or instead of appropriate measures imposed by the supervisory authority pursuant to this Regulation. In a case of a minor infringement or if the fine likely to be imposed would constitute a disproportionate burden to a natural person, a reprimand may be issued instead of a fine. Due regard should however be given to the nature, gravity", "gold": false}, {"chunk": 118, "page": 27, "cite": "Recitals 150–1", "biRank": 9, "biScore": 0.5081, "ceRank": 4, "ceScore": -5.875, "text": "obtained through infringements of this Regulation. However, the imposition of criminal penalties for infringements of such national rules and of administrative penalties should not lead to a breach of the principle of ne bis in idem, as interpreted by the Court of Justice. (150) In order to strengthen and harmonise administrative penalties for infringements of this Regulation, each supervisory authority should have the power to impose administrative fines. This Regulation should indicate (1) Regulation (EU) No 1215/2012 of the European Parliament and of the Council of 12 December 2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (OJ L 351, 20.12.2012, p. 1). infringements and the upper limit and criteria for setting the related administrative fines, which should be determined by the competent supervisory authority in each individual case, taking into account all relevant circumstances of the specific situation, with due regard in particular to the nature, gravity and duration of the infringement and of its consequences and the measures taken to ensure compliance with the obligations under this Regulation and to prevent or mitigate the consequences of the infringement. Where administrative fines are imposed on an undertaking, an undertaking should be understood to be an undertaking in accordance with Articles 101 and 102 TFEU for those purposes. Where administrative fines are imposed on", "gold": false}, {"chunk": 292, "page": 83, "cite": "Art. 83", "biRank": 10, "biScore": 0.5026, "ceRank": 8, "ceScore": -7.733, "text": "provide access in violation of Article 58(1). 6. Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. 7. Without prejudice to the corrective powers of supervisory authorities pursuant to Article 58(2), each Member State may lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State. 8. The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process. 9. Where the legal system of the Member State does not provide for administrative fines, this Article may be applied in such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national courts, while ensuring that those legal remedies are effective and have an equivalent effect to the administrative fines imposed by supervisory authorities. In any event, the fines imposed shall be effective, proportionate and dissuasive. Those Member", "gold": true}], "answers": {"baseline": "Based on the provided context, it is not explicitly stated what the maximum fine is for breaching the basic principles of processing. \n\nWhile Passage 1 provides administrative fine tiers up to \"10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher\" for certain obligations (such as Articles 8, 11, 25 to 39, 42, and 43), paragraph 5 cuts off and does not contain the provisions or fine amounts related to the basic principles of processing.", "reranked": "Based on the provided context, infringements of **the basic principles for processing** (including conditions for consent, pursuant to **Articles 5, 6, 7, and 9**) are subject to administrative fines of:\n\n* Up to **20 000 000 EUR**, or \n* In the case of an undertaking, up to **4 % of the total worldwide annual turnover of the preceding financial year**, whichever is higher (Passage 1, paragraph 5(a)).\n\n### Conditions and Exceptions:\n* **Assessment criteria (Paragraph 2):** When determining whether to impose a fine and its specific amount, due regard must be given to factors including the nature, gravity, and duration of the infringement, intentional or negligent character, mitigation measures taken, degree of cooperation with supervisory authorities, and any aggravating or mitigating factors (Passages 2 and 3).\n* **Multiple infringements limit (Paragraph 3):** If a controller or processor intentionally or negligently infringes several provisions for the same or linked processing operations, the total fine cannot exceed the amount specified for the gravest infringement."}}, {"category": "buried", "query": "At what age can a child give consent for an online service on their own?", "goldSnippets": ["at least 16 years", "not below 13 years"], "gold": [152, 153], "baselineRank": 1, "rerankedRank": 1, "status": "both-hit", "candidates": [{"chunk": 152, "page": 37, "cite": "Arts. 7–8", "biRank": 1, "biScore": 0.6691, "ceRank": 1, "ceScore": 1.615, "text": "shall not be binding. 3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Article 8 Conditions applicable to child's consent in relation to information society services 1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below", "gold": true}, {"chunk": 153, "page": 37, "cite": "Arts. 8–9", "biRank": 2, "biScore": 0.5314, "ceRank": 2, "ceScore": -1.268, "text": "and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years. 2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. 3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child. Article 9 Processing of special categories of personal data 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. 2. Paragraph 1 shall not apply if one of the following applies: (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be", "gold": true}, {"chunk": 45, "page": 11, "cite": "Recitals 58–59", "biRank": 3, "biScore": 0.4788, "ceRank": 6, "ceScore": -8.033, "text": "or her rights. Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller. (58) The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. Such information could be provided in electronic form, for example, when addressed to the public, through a website. This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand. (59) Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal", "gold": false}, {"chunk": 26, "page": 7, "cite": "Recitals 38–39", "biRank": 4, "biScore": 0.4599, "ceRank": 4, "ceScore": -7.42, "text": "by virtue, for example, of ownership, financial participation or the rules which govern it or the power to have personal data protection rules implemented. An undertaking which controls the processing of personal data in undertakings affiliated to it should be regarded, together with those undertakings, as a group of undertakings. (38) Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child. (39) Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communi­ cation relating to the processing of those personal data be easily accessible and easy", "gold": false}, {"chunk": 159, "page": 39, "cite": "Art. 12", "biRank": 5, "biScore": 0.4278, "ceRank": 8, "ceScore": -10.323, "text": "referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means. 2. The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in Article 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights under Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject. 3. The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of", "gold": false}, {"chunk": 21, "page": 6, "cite": "Recitals 32–33", "biRank": 6, "biScore": 0.4107, "ceRank": 3, "ceScore": -6.976, "text": "to the interconnection of filing systems. The processing of personal data by those public authorities should comply with the applicable data-protection rules according to the purposes of the processing. (32) Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided. (33) It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection.", "gold": false}, {"chunk": 210, "page": 56, "cite": "Art. 40", "biRank": 7, "biScore": 0.405, "ceRank": 9, "ceScore": -10.438, "text": "(a) fair and transparent processing; (b) the legitimate interests pursued by controllers in specific contexts; (c) the collection of personal data; (d) the pseudonymisation of personal data; (e) the information provided to the public and to data subjects; (f) the exercise of the rights of data subjects; (g) the information provided to, and the protection of, children, and the manner in which the consent of the holders of parental responsibility over children is to be obtained; (h) the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32; (i) the notification of personal data breaches to supervisory authorities and the communication of such personal data breaches to data subjects; (j) the transfer of personal data to third countries or international organisations; or (k) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing, without prejudice to the rights of data subjects pursuant to Articles 77 and 79. 3. In addition to adherence by controllers or processors subject to this Regulation, codes of conduct approved pursuant to paragraph 5 of this Article and having general validity pursuant to paragraph 9 of this Article may also be adhered to by controllers or processors that are not subject to this Regulation", "gold": false}, {"chunk": 51, "page": 12, "cite": "Recitals", "biRank": 8, "biScore": 0.4028, "ceRank": 5, "ceScore": -7.71, "text": "or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the", "gold": false}, {"chunk": 30, "page": 8, "cite": "Recital 43", "biRank": 9, "biScore": 0.3931, "ceRank": 7, "ceScore": -9.879, "text": "ensure that the data subject is aware of the fact that and the extent to which consent is given. In accordance with Council Directive 93/13/EEC (1) a declaration of consent preformulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. (43) In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance", "gold": false}, {"chunk": 49, "page": 12, "cite": "Recital 63", "biRank": 10, "biScore": 0.3802, "ceRank": 10, "ceScore": -10.441, "text": "the age of the data and any appropriate safeguards adopted should be taken into consideration. (63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. This includes the right for data subjects to have access to data concerning their health, for example the data in their medical records containing information such as diagnoses, examination results, assessments by treating physicians and any treatment or interventions provided. Every data subject should therefore have the right to know and obtain communication in particular with regard to the purposes for which the personal data are processed, where possible the period for which the personal data are processed, the recipients of the personal data, the logic involved in any automatic personal data processing and, at least when based on profiling, the consequences of such processing. Where possible, the controller should be able to provide remote access to a secure system which would provide the data subject with direct access to his or her personal data. That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software.", "gold": false}]}, {"category": "control", "query": "Who pays if a person suffers harm because a company mishandled their data?", "goldSnippets": ["right to receive compensation", "should compensate any damage"], "gold": [110, 114, 115, 285, 286, 287, 288], "baselineRank": 1, "rerankedRank": 1, "status": "both-hit", "candidates": [{"chunk": 110, "page": 26, "cite": "Recitals 142–143", "biRank": 1, "biScore": 0.5686, "ceRank": 6, "ceScore": -8.27, "text": "(142) Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of personal data to lodge a complaint on his or her behalf with a supervisory authority, exercise the right to a judicial remedy on behalf of data subjects or, if provided for in Member State law, exercise the right to receive compensation on behalf of data subjects. A Member State may provide for such a body, organisation or association to have the right to lodge a complaint in that Member State, independently of a data subject's mandate, and the right to an effective judicial remedy where it has reasons to consider that the rights of a data subject have been infringed as a result of the processing of personal data which infringes this Regulation. That body, organisation or association may not be allowed to claim compensation on a data subject's behalf indepen­ dently of the data subject's mandate. (143) Any natural or legal person has the right to bring an action for annulment of decisions of the Board before", "gold": true}, {"chunk": 69, "page": 16, "cite": "Recital 85", "biRank": 2, "biScore": 0.5278, "ceRank": 3, "ceScore": -6.334, "text": "persons, the controller should be responsible for the carrying-out of a data protection impact assessment to evaluate, in particular, the origin, nature, particularity and severity of that risk. The outcome of the assessment should be taken into account when determining the appropriate measures to be taken in order to demonstrate that the processing of personal data complies with this Regulation. Where a data-protection impact assessment indicates that processing operations involve a high risk which the controller cannot mitigate by appropriate measures in terms of available technology and costs of implementation, a consultation of the supervisory authority should take place prior to the processing. (85) A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become", "gold": false}, {"chunk": 170, "page": 43, "cite": "Art. 15", "biRank": 3, "biScore": 0.5157, "ceRank": 8, "ceScore": -9.851, "text": "rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer. 3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. 4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Section 3 Rectification", "gold": false}, {"chunk": 115, "page": 27, "cite": "Recital 146", "biRank": 4, "biScore": 0.5072, "ceRank": 1, "ceScore": -2.999, "text": "unless the controller is a public authority of a Member State acting in the exercise of its public powers. (146) The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation. This is without prejudice to any claims for damage deriving from the violation of other rules in Union or Member State law. Processing that infringes this Regulation also includes processing that infringes delegated and implementing acts adopted in accordance with this Regulation and Member State law specifying rules of this Regulation. Data subjects should receive full and effective compensation for the damage they have suffered. Where controllers or processors are involved in the same processing, each controller or processor should be held liable for the entire damage. However, where they are joined to the same judicial proceedings, in accordance with Member State law, compensation may be apportioned according to the responsibility of each controller or processor for the damage caused by the processing, provided that", "gold": true}, {"chunk": 289, "page": 82, "cite": "Art. 83", "biRank": 5, "biScore": 0.502, "ceRank": 2, "ceScore": -5.114, "text": "whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: (a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; (b) the intentional or negligent character of the infringement; (c) any action taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32; (e) any relevant previous infringements by the controller or processor; (f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; (g) the categories of personal data affected by the infringement; (h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; (j) adherence", "gold": false}, {"chunk": 231, "page": 63, "cite": "Art. 47", "biRank": 6, "biScore": 0.5011, "ceRank": 4, "ceScore": -7.647, "text": "of personal data, measures to ensure data security, and the requirements in respect of onward transfers to bodies not bound by the binding corporate rules; (e) the rights of data subjects in regard to processing and the means to exercise those rights, including the right not to be subject to decisions based solely on automated processing, including profiling in accordance with Article 22, the right to lodge a complaint with the competent supervisory authority and before the competent courts of the Member States in accordance with Article 79, and to obtain redress and, where appropriate, compensation for a breach of the binding corporate rules; (f) the acceptance by the controller or processor established on the territory of a Member State of liability for any breaches of the binding corporate rules by any member concerned not established in the Union; the controller or the processor shall be exempt from that liability, in whole or in part, only if it proves that that member is not responsible for the event giving rise to the damage; (g) how the information on the binding corporate rules, in particular on the provisions referred to in points (d), (e) and (f) of this paragraph is provided to the data subjects in addition to Articles 13 and 14; (h) the tasks of any data protection officer designated", "gold": false}, {"chunk": 285, "page": 80, "cite": "Arts. 79–81", "biRank": 7, "biScore": 0.4968, "ceRank": 7, "ceScore": -8.633, "text": "31.5.2001, p. 43). Article 80 Representation of data subjects 1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law. 2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, in­ dependently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing. Article 81 Suspension of proceedings 1. Where a competent court of a Member State has", "gold": true}, {"chunk": 276, "page": 77, "cite": "Art. 70", "biRank": 8, "biScore": 0.4867, "ceRank": 9, "ceScore": -10.08, "text": "to in Article 47; (j) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for the personal data transfers on the basis of Article 49(1); (k) draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 58(1), (2) and (3) and the setting of administrative fines pursuant to Article 83; (l) review the practical application of the guidelines, recommendations and best practices referred to in points (e) and (f); (m) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing common procedures for reporting by natural persons of infringements of this Regulation pursuant to Article 54(2); (n) encourage the drawing-up of codes of conduct and the establishment of data protection certification mechanisms and data protection seals and marks pursuant to Articles 40 and 42; (o) carry out the accreditation of certification bodies and its periodic review pursuant to Article 43 and maintain a public register of accredited bodies pursuant to Article 43(6) and of the accredited controllers or processors established in third countries pursuant to Article 42(7); (p) specify the requirements referred to in Article 43(3) with a view to the accreditation of certification bodies under Article 42; (q) provide the Commission with an", "gold": false}, {"chunk": 291, "page": 82, "cite": "Art. 83", "biRank": 9, "biScore": 0.4863, "ceRank": 10, "ceScore": -10.838, "text": "the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43; (b) the obligations of the certification body pursuant to Articles 42 and 43; (c) the obligations of the monitoring body pursuant to Article 41(4). 5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: (a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9; (b) the data subjects' rights pursuant to Articles 12 to 22; (c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to Articles 44 to 49; (d) any obligations pursuant to Member State law adopted under Chapter IX; (e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1). 6. Non-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance with paragraph 2 of this Article, be subject to administrative fines up to 20 000", "gold": false}, {"chunk": 275, "page": 77, "cite": "Art. 70", "biRank": 10, "biScore": 0.4746, "ceRank": 5, "ceScore": -7.912, "text": "for further specifying the criteria and conditions for decisions based on profiling pursuant to Article 22(2); (g) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing the personal data breaches and determining the undue delay referred to in Article 33(1) and (2) and for the particular circumstances in which a controller or a processor is required to notify the personal data breach; (h) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph as to the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of the natural persons referred to in Article 34(1). (i) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for personal data transfers based on binding corporate rules adhered to by controllers and binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned referred to in Article 47; (j) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for the personal data transfers on the basis of Article 49(1);", "gold": false}]}, {"category": "degraded", "query": "Can the Commission ask the Board to examine a matter that affects more than one Member State?", "goldSnippets": ["the chair of the board or the commission may request that any matter of general application"], "gold": [264], "baselineRank": 2, "rerankedRank": 8, "status": "degraded", "candidates": [{"chunk": 273, "page": 76, "cite": "Arts. 68–70", "biRank": 1, "biScore": 0.5571, "ceRank": 3, "ceScore": -3.158, "text": "in accordance with that Member State's law. 5. The Commission shall have the right to participate in the activities and meetings of the Board without voting right. The Commission shall designate a representative. The Chair of the Board shall communicate to the Commission the activities of the Board. 6. In the cases referred to in Article 65, the European Data Protection Supervisor shall have voting rights only on decisions which concern principles and rules applicable to the Union institutions, bodies, offices and agencies which correspond in substance to those of this Regulation. Article 69 Independence 1. The Board shall act independently when performing its tasks or exercising its powers pursuant to Articles 70 and 71. 2. Without prejudice to requests by the Commission referred to in point (b) of Article 70(1) and in Article 70(2), the Board shall, in the performance of its tasks or the exercise of its powers, neither seek nor take instructions from anybody. Article 70 Tasks of the Board 1. The Board shall ensure the consistent application of this Regulation. To that end, the Board shall, on its own initiative or, where relevant, at the request of the Commission, in particular: (a) monitor and ensure the correct application of this Regulation in the cases provided for in Articles 64 and 65 without prejudice to the tasks", "gold": false}, {"chunk": 264, "page": 73, "cite": "Art. 64", "biRank": 2, "biScore": 0.5149, "ceRank": 8, "ceScore": -7.433, "text": "to adopt any of the measures below. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it: (a) aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4); (b) concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation; (c) aims to approve the criteria for accreditation of a body pursuant to Article 41(3) or a certification body pursuant to Article 43(3); (d) aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8); (e) aims to authorise contractual clauses referred to in point (a) of Article 46(3); or (f) aims to approve binding corporate rules within the meaning of Article 47. 2. Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62. 3. In", "gold": true}, {"chunk": 113, "page": 26, "cite": "Recital 144", "biRank": 3, "biScore": 0.5148, "ceRank": 10, "ceScore": -9.05, "text": "ruling on the interpretation of Union law, including this Regulation. Furthermore, where a decision of a supervisory authority implementing a decision of the Board is challenged before a national court and the validity of the decision of the Board is at issue, that national court does not have the power to declare the Board's decision invalid but must refer the question of validity to the Court of Justice in accordance with Article 267 TFEU as interpreted by the Court of Justice, where it considers the decision invalid. However, a national court may not refer a question on the validity of the decision of the Board at the request of a natural or legal person which had the opportunity to bring an action for annulment of that decision, in particular if it was directly and individually concerned by that decision, but had not done so within the period laid down in Article 263 TFEU. (144) Where a court seized of proceedings against a decision by a supervisory authority has reason to believe that proceedings concerning the same processing, such as the same subject matter as regards processing by the same controller or processor, or the same cause of action, are brought before a competent court in another Member State, it should contact that court in order to confirm the existence of", "gold": false}, {"chunk": 268, "page": 75, "cite": "Art. 65", "biRank": 4, "biScore": 0.5065, "ceRank": 7, "ceScore": -5.229, "text": "for the main establishment; (c) where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board. 2. The decision referred to in paragraph 1 shall be adopted within one month from the referral of the subject-matter by a two-thirds majority of the members of the Board. That period may be extended by a further month on account of the complexity of the subject-matter. The decision referred to in paragraph 1 shall be reasoned and addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them. 3. Where the Board has been unable to adopt a decision within the periods referred to in paragraph 2, it shall adopt its decision within two weeks following the expiration of the second month referred to in paragraph 2 by a simple majority of the members of the Board. Where the members of the Board are split, the decision shall by adopted by the vote of its Chair. 4. The supervisory authorities concerned shall not adopt a decision on the subject matter submitted to the Board under paragraph 1 during", "gold": false}, {"chunk": 112, "page": 26, "cite": "Recitals", "biRank": 5, "biScore": 0.4964, "ceRank": 6, "ceScore": -5.211, "text": "corrective and authorisation powers by the supervisory authority or the dismissal or rejection of complaints. However, the right to an effective judicial remedy does not encompass measures taken by supervisory authorities which are not legally binding, such as opinions issued by or advice provided by the supervisory authority. Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with that Member State's procedural law. Those courts should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them. Where a complaint has been rejected or dismissed by a supervisory authority, the complainant may bring proceedings before the courts in the same Member State. In the context of judicial remedies relating to the application of this Regulation, national courts which consider a decision on the question necessary to enable them to give judgment, may, or in the case provided for in Article 267 TFEU, must, request the Court of Justice to give a preliminary ruling on the interpretation of Union law, including this Regulation. Furthermore, where a decision of a supervisory authority implementing a decision of the Board is challenged before a national court and the validity of the decision of the Board is", "gold": false}, {"chunk": 261, "page": 73, "cite": "Art. 62", "biRank": 6, "biScore": 0.495, "ceRank": 1, "ceScore": -1.095, "text": "processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. The supervisory authority which is competent pursuant to Article 56(1) or (4) shall invite the supervisory authority of each of those Member States to take part in the joint operations and shall respond without delay to the request of a supervisory authority to participate. 3. A supervisory authority may, in accordance with Member State law, and with the seconding supervisory authority's authorisation, confer powers, including investigative powers on the seconding supervisory authority's members or staff involved in joint operations or, in so far as the law of the Member State of the host supervisory authority permits, allow the seconding supervisory authority's members or staff to exercise their investigative powers in accordance with the law of the Member State of the seconding supervisory authority. Such investigative powers may be exercised only under the guidance and in the presence of members or staff of the host supervisory authority. The seconding supervisory authority's members or staff shall be subject to the Member State law of the host supervisory authority. 4. Where, in accordance with paragraph", "gold": false}, {"chunk": 260, "page": 72, "cite": "Arts. 61–62", "biRank": 7, "biScore": 0.4913, "ceRank": 2, "ceScore": -1.546, "text": "Article within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 55(1). In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant to Article 66(2). 9. The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). Article 62 Joint operations of supervisory authorities 1. The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved. 2. Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall", "gold": false}, {"chunk": 106, "page": 25, "cite": "Recitals 136–137", "biRank": 8, "biScore": 0.4891, "ceRank": 4, "ceScore": -4.119, "text": "also apply where any supervisory authority concerned or the Commission requests that such matter should be handled in the consistency mechanism. That mechanism should be without prejudice to any measures that the Commission may take in the exercise of its powers under the Treaties. (136) In applying the consistency mechanism, the Board should, within a determined period of time, issue an opinion, if a majority of its members so decides or if so requested by any supervisory authority concerned or the Commission. The Board should also be empowered to adopt legally binding decisions where there are disputes between supervisory authorities. For that purpose, it should issue, in principle by a two-thirds majority of its members, legally binding decisions in clearly specified cases where there are conflicting views among supervisory authorities, in particular in the cooperation mechanism between the lead supervisory authority and supervisory authorities concerned on the merits of the case, in particular whether there is an infringement of this Regulation. (137) There may be an urgent need to act in order to protect the rights and freedoms of data subjects, in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded. A supervisory authority should therefore be able to adopt duly justified provisional measures on its territory with a specified", "gold": false}, {"chunk": 265, "page": 74, "cite": "Art. 64", "biRank": 9, "biScore": 0.4831, "ceRank": 5, "ceScore": -4.369, "text": "Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62. 3. In the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. That opinion shall be adopted within eight weeks by simple majority of the members of the Board. That period may be extended by a further six weeks, taking into account the complexity of the subject matter. Regarding the draft decision referred to in paragraph 1 circulated to the members of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision. 4. Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board, using a standardised format any relevant information, including as the case may be a summary of the facts, the draft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory authorities concerned. 5. The Chair of the Board shall, without", "gold": false}, {"chunk": 213, "page": 57, "cite": "Arts. 40–41", "biRank": 10, "biScore": 0.4805, "ceRank": 9, "ceScore": -7.532, "text": "in the situation referred to in paragraph 3 of this Article, provides appropriate safeguards. 8. Where the opinion referred to in paragraph 7 confirms that the draft code, amendment or extension complies with this Regulation, or, in the situation referred to in paragraph 3, provides appropriate safeguards, the Board shall submit its opinion to the Commission. 9. The Commission may, by way of implementing acts, decide that the approved code of conduct, amendment or extension submitted to it pursuant to paragraph 8 of this Article have general validity within the Union. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2). 10. The Commission shall ensure appropriate publicity for the approved codes which have been decided as having general validity in accordance with paragraph 9. 11. The Board shall collate all approved codes of conduct, amendments and extensions in a register and shall make them publicly available by way of appropriate means. Article 41 Monitoring of approved codes of conduct 1. Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code", "gold": false}], "answers": {"baseline": "Yes. According to the provided context, the Commission can request that such a matter be examined by the Board.\n\nSpecifically, Passage 2 (paragraph 2) states:\n> *\"Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion[...]\"*\n\n**Conditions and particular applications mentioned:**\n* The examination is requested **\"with a view to obtaining an opinion.\"**\n* The passage highlights that this applies **\"in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62.\"** \n\n*(Note: While the specific Article heading for this paragraph is not explicitly printed in the passage text, it references obligations under Articles 61 and 62).*", "reranked": "Based on the provided context, it is not explicitly stated whether the Commission can ask the Board to examine a matter that affects more than one Member State. \n\nThe context notes under **Article 69(2)** and **Article 70(1)** that the Board performs tasks \"on its own initiative or, where relevant, at the request of the Commission\" (referencing requests under point (b) of Article 70(1) and Article 70(2)), but the text cuts off before detailing what those specific requests or tasks entail."}}], "latency": {"retrieveMs": 12.73, "rerankMs": 82.62, "llmMs": 9223.5}, "scaling": {"corpus": 305, "fullScanMs": 2650.0, "perPairMs": 8.688524590163935}, "sweep": {"questions": 612, "restored": 93, "degraded": 11}}