A/79/173 Controllers and processors of personal data must take measures to ensure the quality, timeliness, completeness, accuracy and relevance of the data. 3. Principle of purpose specification, necessity, proportionality and temporariness Data must be processed only for specific, explicit and legitimate purposes and must not later be processed in a manner incompatible with those purposes. Only data that are necessary, relevant and appropriate for the purposes of the processing should be processed. Data must be limited and must not be excessive for the purpose for which they were collected. The purpose of the processing of personal data must be specified, legitimate and, when the data are collected, receive a certain amount of publicity or be brought to the attention of the person concerned (the data subject), in order to make it possible subsequently to ensure that: (a) all the personal data collected, recorded or processed remain relevant and adequate for the purposes so specified; (b) none of the said personal data is used or disclosed without the consent of the person concerned or for purposes incompatible with those specified; (c) the period for which the personal data are kept does not exceed that which would enable the achievement of the authorized or permissible purpose of their processing. Personal data must be kept only for as long as necessary to fulfil the purposes for which they are collected or processed and must be deleted or anonymized when they are no longer needed for those purposes. 4. Principle of interested person (data subject) access Everyone who offers proof of identity has the right to know whether information concerning him or her is being processed and to obtain it in an intelligible form, without undue delay or expense, and to have appropriate rectifications or erasures made in the case of unlawful, unnecessary or inaccurate entries and, when it is being communicated, to be informed of the addressees. Provision should be made for a remedy, if need be, with the authority responsible for ensuring respect for these principles. The cost of any rectification should be borne by the controller or processor of the personal data. It is desirable that the provisions of this principle should apply to everyone, irrespective of nationality or place of residence. 5. Principle of non-discrimination and non-manipulation Subject to cases of exceptions restrictively envisaged under principle 6, data likely to give rise to unlawful or arbitrary discrimination, including information on an individual’s racial or ethnic origin, religious, philosophical or other beliefs, membership in an association or trade union, social or human rights organization or organization that promotes the interests of any political party or that safeguards the rights of opposition parties, as well as data relating to health, sexual life and sexual preferences, genetic or biometric data intended to uniquely identify a natural person, and also neural data, must not be recorded. The processing of neural data, or neurodata, must not be used to manipulate or alter the freedom of thought and consciousness of an individual, making him or her dependent on a third party or altering his or her ideas, security or independence or his or her natural cerebral identity or neurocognitive integrity. Nor may such data be processed for purposes other than the promotion of health and the diagnosis, rehabilitation and alleviation of disease in the context of the right to health, or scientific research in the fields of biology, psychology and medicine aimed at alleviating suffering or improving health. 24-13146 17/23