S.L. 409.24 Art. 9Processing of personal data.        Cap. 586.

(1) Any processing of personal data conducted by the

Authority for the purposes of performing its tasks under these regulations shall fully comply with the provisions of Regulation (EU)

2016/679 of the European Parliament and of the Council of 27 April

2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing

Directive 95/46/EC (General Data Protection Regulation) and the Data

Protection Act, including the regulations made thereunder and the fundamental rights and freedoms of the data subjects.

(2) The Authority acting in its capacity of a controller in terms of Article 4(7) of Regulation (EU) 2016/679 shall perform the relevant processing operations which are strictly necessary for the purposes of these regulations.

(3) The Authority, whilst taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of the data subjects, shall implement appropriate technical and organisational measures, in an effective manner and to integrate the necessary safeguards into the processing, in order to protect the rights of the data subjects and to ensure a level of security appropriate to the risk.

(4) For the purposes of ensuring and of being able to demonstrate that the processing of personal data is performed in accordance with the provisions of Regulation (EU) 2016/679, the Authority shall implement the appropriate data protection policies, which policies shall be periodically reviewed and updated where necessary.

(5) The Authority shall ensure that the physical and, or electronic access to personal data processed for the purposes of these regulations shall be strictly granted to personnel authorised by it on the basis of a role-base access control mechanism and subject to confidentiality and, or professional secrecy obligations, in order to prevent abuse or unlawful access to, or disclosure of personal data.

(6) The data protection officer designated by the Authority in accordance with Article 37(1)(a) of Regulation (EU) 2016/679 shall be involved and consulted properly and in a timely manner on all issues in relation to the protection of personal data.

(7) The Authority may, for the purposes of enforcing these regulations or any other applicable law, disclose or communicate any data or information collected by it, provided that such disclosure or communication is authorised by law. ANNEX 1 – GENERAL DESIGN CRITERIA