In principle, the GDPR forbids the processing of personal data, unless it is conducted for legitimate and lawful purposes<\/strong>[1]<\/a><\/sup>.<\/p>\n A purpose<\/strong> describes a concrete objective that shall be reached by the processing.<\/p>\n Legitimate<\/strong> means compliance with the letter of the law (not limited to the GDPR), the spirit of the law (e.g., without exploiting legal loopholes), the values of society (as for example expressed in the European Charter of Fundamental Rights), and the principles of ethics. In certain areas of research, compliance with ethics may be verified in formal procedures such as approval by a research ethics committee.<\/p>\n Lawfulness<\/strong> is defined in Article 6 GDPR. In particular, for processing to be lawful, its purposes must fall into one of six foreseen categories that are called legal basis[2]<\/a><\/sup>. Controllers are only allowed to process personal data if they can present a valid legal basis.<\/p>\n In terms of the problem addressed by data protection, this means that gaining power over individuals is only then permitted when it serves legitimate purposes of the kinds foreseen in the GDPR. References<\/strong><\/p>\n 1<\/sup>See Article 5(1)(a) and (b) GDPR. \u2191<\/a><\/p>\n 2<\/sup>See Article 6(1) GDPR. \u2191<\/a><\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":"
\n <\/p>\n
\n