Article 9(2)(g) of Regulation 2016/679 and Article 10(2)(g) of Regulation 2018/1725 thereby make subject to three conditions the possibility of processing the personal data referred to in Article 9(1) and Article 10(1) of those regulations respectively. First, the processing must pursue a significant public interest, with its basis in EU law. Second, the processing must be necessary to fulfil that public interest. Third, EU law must be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.