Cap. 602 Art. 73AThe processing of personal data by the entities under this Act. Cap. 586.       Cap. 586.

(1) Without prejudice to the provisions of this Act,

Regulation (EU) 2016/679 and the Data Protection Act, including the regulations made thereunder shall apply to all functions and procedures under this Act, and the fundamental rights and freedoms of the data subjects shall be respected by each and every entity.

(2) Relevant entities mentioned in this Act including the Director (Child Protection), the Director Alternative Care (Children and Youths), the Review Board, the Fostering Board and the Board of Appeal, in their capacity as data controllers shall process personal data, including special categories of personal data, in accordance with the data protection principles pursuant to Article 5 of Regulation (EU) 2016/679.

(3) Taking into account the nature, scope, context and purposes of the processing, the entities abovementioned shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk posed, and in particular prevent unauthorised disclosure of, or unlawful access to information pertaining to data subjects.

(4) Where the Director (Child Protection) and, or the Director Alternative Care (Children and Youths) processes information about data subjects pursuant to their functions under this Act and for the purposes which derive therefrom, the Director (Child Protection) and, or the Director Alternative Care (Children and Youths) may restrict the rights and obligations provided for in Articles 14 to 20 and Article 34 of Regulation (EU) 2016/679:

Provided that such rights and obligations shall only be restricted in those cases where the restriction is considered as a necessary and proportionate measure to enable the Director (Child Protection) and, or the Director Alternative Care (Children and Youths) to exercise their functions pursuant to this Act:

Provided further that the data protection officer designated pursuant to Article 37 of Regulation (EU) 2016/679 shall, when necessary, be consulted in a timely manner in the entire process of applying the restriction.

(5) The Director (Child Protection) and, or the Director Alternative Care (Children and Youths), shall only apply the restriction referred to in sub-article (4) for as long as the reasons justifying it remain applicable following a necessity and proportionality test:

Provided that such reasons justifying the restriction shall be documented and made available to the Information and Data Protection Commissioner when and as required.

(6) Where the reasons for a restriction no longer apply, the Director (Child Protection) and, or the Director Alternative Care (Children and Youths) shall lift the restriction and inform the data subject concerned accordingly and comply with the rights and obligations provided for in Articles 14 to 20 and Article 34 of Regulation (EU) 2016/679.

(7) The Director (Child Protection) and, or the Director Alternative Care (Children and Youths) shall review on an annual basis the application of the restriction referred to in sub-article (4) and depending on the outcome of such review, inform the data subject accordingly.

(8) For the purpose of safeguarding the rights and freedoms of the data subjects, the following conditions and safeguards shall apply to the information processed in relation to the data subjects, which data shall be subject to a restriction in terms of sub-article (4):

(a) the data protection officer of the Foundation for Social Welfare Services shall keep a register to record the restrictions applied by the Director (Child Protection) and, or the Director Alternative Care (Children and Youths) in relation to the data protection requests made by the data subjects. The register shall include the details of the data subjects, the right requested to be exercised, the purpose of the restriction and the reason for justifying the restriction following the exercise of a necessity and proportionality test. The restriction of the obligation set forth in Article 34 of Regulation (EU) 2016/679 shall also be recorded in the register;

(b) data subjects shall be informed of the restriction applied by the Director (Child Protection) and, or the Director Alternative Care (Children and Youths) in reply to their request to exercise any of the rights in terms of Regulation (EU) 2016/ 679, unless this may be prejudicial to the purpose of the restriction:

Provided that upon a request by the Information and Data Protection Commissioner, the Director (Child Protection) and, or the Director Alternative Care (Children and Youths) shall clearly demonstrate the prejudice that they would suffer.

(9) Records and documentation kept and stored by the Director

(Child Protection) and, or the Director Alternative Care (Children and

Youths) shall be kept according to the retention policy of the respective Directorate. Once this time period would have elapsed, data shall be disposed of according to the Data Protection Act.