1. Member States shall provide for the controller, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, both at the time of the determination of the means for processing and at the time of the processing itself, to implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data protection principles, such as data minimisation, in an effective manner and to integrate the necessary saf ...[+++]eguards into the processing, in order to meet the requirements of this Directive and protect the rights of data subjects.

Eurostat published the following advice in 2013: the accounting treatment of the Bank of England Asset Purchase Facility Fund (BEAPFF) and flows between the Bank of England and HM Treasury in the United Kingdom, the statistical treatment of a concession sale before privatisation in Portugal, the recapitalisation of the Dexia Group in Belgium, the classification of the Sociedad de activos de Restructuracion (SAREB) in Spain, the recording of financial corrections related to EU funds in accordance with Regulation 1083/2006 art 100(1) in Romania, the statistical treatment of the mobile phone spectrum 15 years concession in Hungary, the trea ...[+++]tment of the LAK Invest Real estate transaction in the Flemish Region in Belgium, the recording of IABF Guarantee Fee in the Netherlands, the treatment of tax refunds, penalty payments and interim payments in the Her Majesty's Revenue and Customs (HMRC) tax case in the United Kingdom, the recording of cancellation of payables related to penalties and fines to be paid by CFR Cai Ferate to private energy suppliers in Romania and the statistical classification of MyCSP Ltd. in the United Kingdom.

In particular, delegated acts should be adopted in respect of lawfulness of processing; specifying the criteria and conditions in relation to the consent of a child; processing of special categories of data; specifying the criteria and conditions for manifestly excessive requests and fees for exercising the rights of the data subject; criteria and requirements for the information to the data subject and in relation to the right of access; the right to be forgotten and to erasure; measures based on profiling; criteria and requirements in relation to the responsibility of the controller and to data protection by design and by defaul ...[+++]t; a processor; criteria and requirements for the documentation and the security of processing; criteria and requirements for establishing a personal data breach and for its notification to the supervisory authority, and on the circumstances where a personal data breach is likely to adversely affect the data subject; the criteria and conditions for processing operations requiring a data protection impact assessment; the criteria and requirements for determining a high degree of specific risks which require prior consultation; designation and tasks of the data protection officer; codes of conduct; criteria and requirements for certification mechanisms; criteria and requirements for transfers by way of binding corporate rules; transfer derogations; administrative sanctions; processing for health purposes; processing in the employment context and processing for historical, statistical and scientific research purposes.

2. Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union, and the controller or processor is established in more than one Member State, the supervisory authority of the main establishment of the controller or processor shall be competent for the supervision of the processing activities of the controller or the processor in all Member States, without prejudice to the provisions of Chapter VII of this Regulation.

The protection of individuals with regard to the processing of personal data by the Member States is governed by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (12) and the protection of individuals with regard to the processing of personal data by the Commission is governed by Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodi ...[+++]es and on the free movement of such data (13) in particular as regards the requirements of confidentiality and security of processing, the transfer of personal data from the Commission to the Member States, the lawfulness of processing, and the rights of data subjects to information, access to and rectification of their personal data.

(46) Whereas the protection of the rights and freedoms of data subjects with regard to the processing of personal data requires that appropriate technical and organizational measures be taken, both at the time of the design of the processing system and at the time of the processing itself, particularly in order to maintain security and thereby to prevent any unauthorized processing; whereas it is incumbent on the Member States to ensure that controllers comply with these measures; whereas these measures must ensure an appropriate level of security, taking into account the state of the art and the costs of their implementation in relati ...[+++]on to the risks inherent in the processing and the nature of the data to be protected;