1 Personal data may only be processed lawfully.
2 Its processing must be carried out in good faith and must be proportionate.
3 Personal data may only be processed for the purpose indicated at the time of collection, that is evident from the circumstances, or that is provided for by law.
4 The collection of personal data and in particular the purpose of its processing must be evident to the data subject.
5 If the consent of the data subject is required for the processing of personal data, such consent is valid only if given voluntarily on the provision of adequate information. Additionally, consent must be given expressly in the case of processing of sensitive personal data or personality profiles.