1. by public and private bodies if
   1. processing is necessary to exercise the rights derived from the right of social security and social protection and to meet the related obligations;
   2. processing is necessary for the purposes of preventive medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services or pursuant to the data subject’s contract with a health professional and if these data are processed by health professionals or other persons subject to the obligation of professional secrecy or under their supervision; or
   3. processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices; in addition to the measures referred to in subsection 2, in particular occupational and criminal law provisions to ensure professional secrecy shall be complied with;
2. by public bodies if
   1. processing is urgently necessary for reasons of substantial public interest;
   2. processing is necessary to prevent a substantial threat to public security;
   3. processing is urgently necessary to prevent substantial harm to the common good or to safeguard substantial concerns of the common good; or
   4. processing is necessary for urgent reasons of defence or to fulfil supra- or intergovernmental obligations of a public body of the Federation in the field of crisis management or conflict prevention or for humanitarian measures;

and as far as the interests of the controller in data processing in the cases of no. 2 outweigh the interests of the data subject.

1. technical organizational measures to ensure that processing complies with Regulation (EU) 2016/679;
2. measures to ensure that it is subsequently possible to verify and establish whether and by whom personal data were input, altered or removed;
3. measures to increase awareness of staff involved in processing operations;
4. designation of a data protection officer;
5. restrictions on access to personal data within the controller and by processors;
6. the pseudonymization of personal data;
7. the encryption of personal data;
8. measures to ensure the ability, confidentiality, integrity, availability and resilience of processing systems and services related to the processing of personal data, including the ability to rapidly restore availability and access in the event of a physical or technical incident;
9. a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing;
10. specific rules of procedure to ensure compliance with this Act and with Regulation (EU) 2016/679 in the event of transfer or processing for other purposes.