GLOSSARY OF TERMS

"personal data" means any information relating to an identified or identifiable natural or legal person (hereinafter referred to as "data subject"); an identifiable natural or legal person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an identifier on the Internet, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural or legal person;

"processing" means any operation or set of operations which is performed upon personal data or upon sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

"profiling" means any form of automated processing of personal data which involves the use of personal data for the purpose of evaluating certain personal aspects relating to an individual, in particular for the purpose of analysing or predicting that individual's performance at work, economic situation, health, personal taste, interests, reliability, behaviour, location or movements;

"collection" means any structured set of personal data which are accessible in accordance with specific criteria and which may be centralised, decentralised or dispersed on a functional or geographical basis;

"controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of the processing are determined by Union law or by the law of a Member State, the controller or the specific criteria for its designation may be determined by Union law or by the law of a Member State;

"processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

"recipient" means the natural or legal person, public authority, agency or other body to whom the personal data have been disclosed, whether or not a third party. However, public authorities which may receive personal data in the context of an individual enquiry in accordance with Union or Member State law are not considered to be recipients; the processing of those data by those public authorities is carried out in accordance with the applicable data protection rules in relation to the purposes of the processing;

"third party" means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons authorised to process personal data under the direct authority of the controller or processor;

"consent of the data subject" means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies his or her agreement to the processing of personal data concerning him or her;

"data concerning health" means personal data relating to the physical or mental health of an individual, including the provision of health care services, and revealing information about his or her state of health;

"relevant and reasoned objection" means an objection to a draft decision as to whether the Regulation has been infringed or as to whether action is envisaged in relation to the controller or processor in accordance with this Regulation, clearly indicating the significance of the risk posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free movement of personal data within the Union.