S.L. 386.34 Art. 13Processing of personal data by the Registrar.   Cap. 586.

(1) Any processing of personal data conducted by the

Registrar in its capacity of a controller in terms of Article 4(7) of

Regulation (EU) 2016/679, shall fully comply with the provisions of

Regulation (EU) 2016/679 and the Data Protection Act, including any regulations made thereunder and the fundamental rights and freedoms of the data subjects.

(2) The Registrar shall be responsible for ensuring the security of the repository, including safeguarding the ongoing confidentiality, integrity and availability of the personal data processed within the repository for the purposes of these regulations.

(3) The Registrar, while taking into account the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of the data subjects, both at the time of the determination of the means for processing as well as at the time of the processing itself, shall implement appropriate technical and organisational measures, in an effective manner and integrate the necessary safeguards into the processing in order to protect the rights of the data subjects and to ensure a level of security appropriate to the risk.

(4) The Registrar shall monitor the effectiveness of the security measures implemented in relation to the repository and take the necessary organisational measures related to self-monitoring and supervision to ensure compliance with the principle of integrity and confidentiality as established in Article 5(1)(f) of Regulation (EU) 2016/679.

(5) The Registrar shall provide its employees with appropriate training covering, in particular, on data security and data protection rules and applicable fundamental rights, before enabling its employees to handle any personal data within the repository.

(6) The Registrar shall ensure that the relying parties with a right to access the repository create profiles describing the functions and responsibilities of the officers or employees who are authorised to access the repository.

(7) The Registrar shall ensure that the relying parties authorised to access the repository have access only to the data covered by their access authorisation, by means of individual user identities and confidential access modes only.

(8) The data protection officer designated by the Registrar in accordance with Article 37(1)(a) of Regulation (EU) 2016/679, shall be involved and consulted in a timely manner on all matters in relation to the protection of personal data processed within the repository.

(9) For the purposes of ensuring and to be able to demonstrate that the processing of personal data is performed in accordance with the provisions of Regulation (EU) 2016/679, the Registrar shall implement the appropriate data protection policies, which policies shall be periodically reviewed and updated where necessary.