S.L. 386.34 Art. 8Access by competent authorities.

(1) The data, information and reports held in the repository shall, through the use of APIs or any other technical means, be accessible by any competent authority upon the selective disclosure of the user, in conformity with the procedures established by the Registrar, who shall access and make use of the data, information and reports contained in the repository on a case-by-case basis and to the extent that this shall be necessary for the prevention, detection, investigation or prosecution of money laundering, associated predicate offences, funding of terrorism or any other serious criminal offence. For the avoidance of any doubt this shall include supporting investigations concerning any such offence, including the identification, tracing and freezing of the assets related to such investigation.

(2) The data, information and reports contained in the repository may also be used to produce such aggregate or statistical data as may be required by the competent authorities for the same purposes as are referred to in sub-regulation (1).

(3) Each competent authority accessing data, information and reports contained in the repository in accordance with these regulations shall:

(a) designate one (1) or more officers or employees that shall have access to the repository, with each designated officer or employee being granted the said rights only upon undergoing such registration or accreditation process, as may be established by the Registrar;

(b) implement the appropriate safeguards to ensure that data, information and reports held in the repository are accessed and used only when required for the purposes established in regulation 7(1);

(c) have due regard to the sensitive nature of the data, information and reports processed:

(i) to ensure that the officers and employees maintain high professional standards of confidentiality and adhere with any applicable data protection law, including through monitoring compliance with the said requirements, and that all their officers and employees are of high integrity;

(ii) to provide any officer or employee designated in terms of sub-regulation (4) or any officer or employee able to request any such employee to use the repository, with the appropriate data protection training covering, in particular, the handling of personal data through the repository in accordance with the applicable data protection law;

(iii) to establish internal policies and procedures establishing the conditions and circumstances in which data, information and reports are to be obtained from the repository, and processed for the purposes specified in regulation 7(1);

(iv) to implement the appropriate technical and organisational measures to ensure the security of the data, information and reports to high technological standards; and

(v) to ensure that the Registrar is promptly informed whenever an officer or employee is no longer to be considered as a designated employee in terms of sub-regulation (3).

(d) whenever the competent authority becomes aware that the data, information or reports held in the repository are not correct or are otherwise not up-to-date, the competent authority concerned shall immediately notify the Registrar;

(e) hold statistical data on the number of requests and the data, information and reports that have been obtained, collected and received by them through the repository, and shall make the same available to the Registrar.

(4) Any data, information or reports obtained through the repository shall be kept confidential by the competent authorities and by their officers, employees or agents, past and present, and any use thereof other than for the purposes established in these regulations shall be considered as an unauthorised disclosure of the same:

Provided that competent authorities may, upon a lawful request from another competent authority and where necessary for the prevention, detection, investigation or prosecution of money laundering, associated predicate offences, the funding of terrorism, or any other serious criminal offence, share with such competent authority any data, information and reports obtained through the repository.