2. Obliged entities shall be able to process personal data covered by Article 9 of Regulation (EU) 2016/679 provided that:
|
(a)
|
they inform their customers or prospective customers that such categories of data may be processed for the purpose of complying with the requirements of this Regulation;
|
|
(b)
|
the data originate from reliable sources, are accurate and up-to-date;
|
|
(c)
|
they do not take decisions that would lead to biased and discriminatory outcomes on the basis of those data;
|
|
(d)
|
they adopt measures of a high level of security in accordance with Article 32 of Regulation (EU) 2016/679, in particular in terms of confidentiality.
|