The following principles must be satisfied when personal data is collected and processed:

• All personal data must be processed fairly and lawfully for specific, explicit and legitimate purposes and subsequently processed in accordance with these purposes;

• All personal data collected must be adequate, relevant and non-excessive in view of the purposes for which it is collected;

• All personal data must be accurate and comprehensive and when necessary, kept up to date;

• All personal data must be retained no longer than is necessary for the purposes for which it is processed.

The processing of personal data must receive the data subject's prior consent or fulfill one of the following conditions:

• Compliance with a legal obligation of the data controller;

• The purpose of the processing is to protect the individual's life;

• The purpose of the processing is to carry out a public service;

• The processing relates to the performance of a contract to which the concerned individual is a party, or pre-contractual measures requested by that individual;

• Processing relates to the realisation of the legitimate interest of the data controller or the data recipient, subject to the interest and fundamental rights and liberties of the concerned individual.

The conditions for processing of sensitive personal data include most of the above conditions, but contain an additional list of more restrictive conditions that must also be satisfied such as requirement to obtain prior consent of the data subject, or in the absence of consent where the processing is undertaken to carry out a public service and is required by law or priorly authorised by the CMIL.