Article 5 of Regulation (EC) No 45/2001 lays down the conditions for lawful processing of personal data by the EC institutions and bodies. Consent is but one of these conditions. It may be lawful to process personal when this is necessary for each of the following other (legitimizing) reasons:

• for the performance of a task carried out in the public interest;
• for compliance with a legal obligation to which the controller is subject;
• for the performance of a contract to which the data subject is party;
• to protect the vital interests of the data subject.

Regulation (EC) No 45/2001 prohibits the processing of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and of data concerning health or sex life. There are a limited number of exceptions to the prohibition, including express consent by the data subject (Article 10 of the Regulation).

Certain processing operations, although not prohibited, may present specific risks to the rights and freedoms of data subjects by virtue of their nature, their scope or their purposes - they shall therefore be subject to prior checking by the EDPS. Such processing operations include the processing of data relating to:

• suspected offences, offences, criminal convictions or security measures; as well as
• processing operations intended to evaluate personal aspects relating to the data subject, including his or her ability, efficiency and conduct.