The Processing of Personal Data (Protection of Individuals) Law of 2001 was put in force in order to deal with matters of protection of private life resulting from the continuously increasing collection, registration, spread and use of personal information. The Law provides certain rights to individuals (subjects of data), while it establishes at the same time specific obligations to those dealing with personal information (the competent persons for processing).

“Personal data" means every piece of information referring to natural person still in life. The personal information is characterized as “sensitive” and they are treated with greater protection when referring to national or racial origin, health, political beliefs, convictions etc.

“Processing” means mainly the automated processing, that is the processing made by the use of computers and includes the collection, registration, keeping, announcement, deletion etc of information. The Law applies also for files which are not automated but they are somehow structured so that the data can be found based on certain criteria.

The Law does not apply when the processing is made exclusively for personal activities, if for example I have registered in my computer personal information which I use for personal purposes, i.e. list and contact details of doctors etc.

The purpose and objective of the law is not to render more difficult and impede the activities carried out by people collecting and processing personal data, but to set the principles and the conditions based on which such processing will be lawful and permissible.

The essential principles rendering the processing lawful are:

• The principle of purpose: the personal data must be collected and be processed for specified, implicit and lawful purpose and no any later processing will take place which will be inconsistent with such purpose.
• The principle of proportionality: the data collected must be relative and not more that what it is required each time for achieving the purpose for which they were originally collected.
• The Principle of preciseness: the data must be precise and be updated when necessary and
• The principle of keeping: the data must be kept only for as long as it is necessary for the purpose of processing.
• Only when the above principles apply the processing will be considered lawful, for which in general it must be ensured the consent of the subject of processing.