Cap. 261 Art. 32Data protection.

(1) Nothing in this Act shall prejudice the applicability of the General Data Protection Regulation (Regulation (EU) 2016/679)

(‘GDPR’)and the Data Protection Act and the fundamental rights and freedoms of the data subject.

(2) Where the Authority in its capacity of data controller processes personal data on the applicant or the beneficiary and, or their dependants, as established under this Act, it shall:

(a) comply with the principles relating to processing of measures to ensure a level of security appropriate to the risk posed, and prevent abuse or unlawful access to or transfer of, personal data pertaining to the applicant or the beneficiary and, or their dependants.

(3) The controller shall retain the personal data of the applicant, beneficiary and, or their dependants as long as the granted benefit, subsidy and, or service remains in force:

Provided that where the application for a benefit, subsidy and, or service is refused, or where this benefit, subsidy and, or service is revoked and, or discontinued, such personal data shall be retained for the purposes of this Act for a period of five (5) years from the date of the refusal of the application or the revocation of the decision to discontinue the benefit, subsidy and, or service thereof.

(4) Where the Authority pursuant to its functions under this Act processes information in relation to the verification and analysis of personal data within the context of an investigation against fraud, the Authority may restrict the rights and obligations provided for in Articles 14 to 20 and Article 34 of the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’) in accordance with Article 23 of the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’):

Provided that such personal data shall only be restricted in case the Authority refuses the application or revokes and, or discontinues the benefit, subsidy and, or service thereof:

Provided further that the Authority’s Data Protection Officer designated pursuant to Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’) shall be consulted as appropriate in a timely manner during the entire process of the application of the restriction.

(5) The restriction under sub-article (4) shall only apply in the event that this restriction is considered as necessary and proportionate measure to protect the sources and confidentiality of legally privileged information.

(6) The Authority shall apply the restriction referred to in sub-article (4) for as long as the reasons justifying them remain applicable following a necessity and proportionality test:

Provided that such reasons justifying the restrictions shall be documented and made available to the Information and Data Protection Commissioner when and as required. Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’).

(8) The Authority shall review the application for the restrictions referred to in this Act every year and depending on the outcome of such review, inform the data subject accordingly.

(9) For the safeguard of the rights and freedoms of the data subjects, the following conditions and safeguards shall apply to documents, reports and other personal data processed which are subject to the restriction in terms of sub-article (4):

(a) access to verification and analysis data by competent authorities other than the Authority shall not be permitted unless provided for by law;

(b) the Authority shall maintain an audit trail record of access to verification and analysis data by the competent authorities, containing at least the date of the access, the identifiable details of the Authority’s officer accessing the data, the competent authority making the request and the purpose for the access. Such audit trail record shall be kept for as long as the verification and analysis data is stored in conformity with this Act;

(c) the Authority’s Data Protection Officer shall keep a register to record the restrictions applied in relation to the requests made by the applicants, beneficiaries and, or their dependants. The register shall include the details of the data subjects, the right requested to be exercised that was restricted and the purpose for such restriction. Restriction of rights in terms of Article 34 of the General Data Protection Regulation (Regulation

(EU) 2016/679) (‘GDPR’) shall also be recorded in the register; and

(d) the applicants, beneficiaries and, or their dependants, in their capacity as data subjects shall be informed of the application of restrictions to their rights by informing the data subject concerned in reply to the request to exercise any of the rights which are being restricted in terms of this Act and the publication of the information, unless this may be prejudicial to the purpose of the restriction:

Provided that the Agency shall justify the prejudice claimed by it to the Information and Data Protection Commissioner when and where requested.