The default rule is that your personal data must be collected directly from you. However, the law permits a Controller to collect your data from another source under specific circumstances, such as: 

• You have given your consent. 

• The data was collected from a publicly available source. 

• The Controller is a public entity and requires the data for security, legal, or judicial purposes. 

• Collecting the data directly from you could cause you harm or affect your vital interests. 

• The collection is necessary to protect public health or an individual’s life. 

Generally, your personal data may only be processed for the purpose for which it was originally collected. Using it for a new purpose is only allowed under the same set of exceptions that permit collecting it from a source other than you. This includes obtaining your consent, if the processing is required for public safety, or if it is necessary for the Controller’s legitimate interests, among other reasons.

While consent is the primary basis for processing, several exceptions allow for processing without it. These include: 

• Public Interest and Safety: Processing is permitted if it is necessary to protect public health or safety, or the life of an individual. Similarly, a public entity can process data for security or legal requirements. 

• Legitimate Interests: A Controller may process your data to achieve their legitimate interests. However, this is subject to two important conditions: the processing must not infringe on your rights and interests, and it cannot be used for processing Sensitive Data. 

• Publicly Available Data: If your personal data is already publicly available, it can be processed without separate consent. 

• Anonymization: Processing is allowed if the data is handled in a way that it can no longer be used to identify you directly or indirectly.