§ 47 General principles for processing personal data

Personal data shall be

  1. processed lawfully and fairly;
  2. collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with those purposes;
  3. adequate, relevant and not excessive in relation to the purposes for which they are processed;
  4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
  5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which they are processed;
  6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.