Newsletter-21

404 NEWSLETTER 2016 • If mandatory for the legitimate interests of the data control- ler, given that this does not infringe upon the fundamental rights of the data subject.” (Art. 5/2) However, such criteria solely applies to the processing of the gen- eral type of personal data, such as the name, surname, date and place of birth, details of physical appearance, social security number, IP ad- dress, e-mail address, hobbies and preferences. The Law provides for a sub-category, which is the specially categorized data, and defined as the personal data relating to the ethnicity, origin, political, religious and philosophical views, information on health and sexual life,union memberships, criminal records, biometric and genetic data (Art. 6/1, Art. 6 of the Convention No. 108). Such data shall not be processed without the explicit consent of the data subject (Art. 6/2). However, the specially categorized data, except as it relates to health and sexual life, may be processed without explicit consent if provided so by law (Art. 6/3). In addition, the LPPD regulates the erasure, destruction, anonymization, disclosure and transmission of personal data (Art. 7-9). The Obligations of the Data Controller and the Rights of the Data Subject The LPPD imposes an obligation upon the data controller to provide its identity, the intent under which the data is processed, to whom and why this data might be transmitted, the reason and method of data collection, and his/her rights (Art. 10). The data controller also is obliged to oversee and provide for the sound implementation of the Law (Art. 12). The rights of the data subject, which are explicitly laid out, may be summarized, as follows: • “To know whether one’s personal data is processed or not • To request information on such process, if the personal data is processed • To know the aim of processing of one’s data and whether this aim is complied with