S.L. 373.3 Art. 7Keeping and access to logs.

(1) The Unit shall establish such procedures as it may deem proper to monitor and regulate the access and the carrying out of searches for data and information contained in the register, which procedures shall include the retention of the following information with respect to each search:

(a) the case reference number;

(b) the date and time of the query or search;

(c) the type of data used to launch the query or search;

(d) the unique identifier of the results;

(e) the name of the authority consulting the registry;

(f) the unique user identifier of the designated officer or employee referred to in regulation 6(5) and, where applicable, of the official who ordered the query or search and, as far as possible, the unique user identifier of the recipient of the results of the query or search.

(2) The information referred to in sub-regulation (1)(a) to

(f) shall be:

(a) held only to monitor confidentiality and data protection requirements, including checking the admissibility of a request and the lawfulness of data processing, and for ensuring data security;

(b) accessible only to the data protection officer of the Unit, who shall check the same on a regular basis, and, upon request, to the Information and Data Protection Commissioner; and

(c) protected by appropriate measures against unauthorised access and shall be erased five (5) years after its creation, unless it is required for monitoring procedures that are ongoing.

(3) Any data or information obtained through the register shall be kept confidential by the authorities and by their officers, employees or agents, past and present, and any use thereof other than for the purposes set out in regulation 6 shall be considered to be an unauthorised disclosure of the same.

(4) In the event that the authorities listed in regulation 6(1) become aware of any unauthorised or unjustified access to, or use of, the register, they shall promptly inform the Unit and provide it with any information in relation to any such unauthorised or unjustified access or use as may be requested by the Unit.

(5) The Unit may, where it considers that any of the authorities are not implementing the necessary safeguards to prevent unauthorised or unjustified access to, or use of, the register and of the data and information contained therein, or are otherwise failing to comply with any of their obligations under these regulations, restrict, suspend or terminate the authority’s access and only reinstate the same again once the authority has implemented the necessary measures to prevent the same from occurring again. ACCOUNT REGISTER