S.L. 386.34 чл. 15Verification and authentication.                  Cap. 586.

(1) The Registrar shall ensure that all data and information uploaded or transmitted through the repository by a user are subject to electronic verification and validation, in order to ensure the accuracy, authenticity and integrity of such data and information.

(2) For the purposes of sub-regulation (1), the Registrar shall have the power to carry out checks to ensure the verification of the identity of any user who shall request access to the repository, as well as any data and information being uploaded or stored on the repository by such user, including through the use of APIs or any other technical means, such as the use of electronic identification systems, or any other system, insofar as such system operates in accordance with these regulations: Provided that where any system used for the purpose of this regulation is operated or supplied by a third party, the Registrar shall only rely on the use of such system after it has ascertained that the third party operating or supplying such system shall apply to that processing activity, appropriate technical and organisational measures to ensure an appropriate level of security to the risk posed, and shall integrate the necessary safeguards into the processing, in order to protect the rights and freedoms of data subjects, and that such processing activity shall be carried out in accordance with any obligations incumbent on the Registrar or the third party in accordance with Regulation (EU) 2016/679, as well as any obligations arising from the Data Protection Act including the regulations made thereunder.

(3) For the purposes of effectively operating the repository, there may be the processing of biometric data only where such processing is strictly necessary for reasons of substantial public interest, in particular for the prevention of identity fraud, including by ensuring the secure and reliable verification and validation of the identity of users. Such processing shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to protect the fundamental rights and the interests of the data subjects.

(4) The Registrar may, where necessary for the proper implementation and attainment of the purposes of the repository under these regulations request, access, obtain, process and use any information relating to users from public authorities or bodies established by law, and any registries or other repositories administered by the same, and any such public authority or body shall, subject to any procedures established by it, provide the Registrar with such data and information, including through the use of APIs or any other technical means.