S.L. 452.138 Art. 5Processing of personal data by the employer.            Cap. 586.

(1) Any personal data obtained by the employer in connection with miscarriage leave, including but not limited to the medical certificate and the declaration referred to in regulation 4, shall be processed in accordance with the principles of security and confidentiality of the personal data, in a manner to ensure the prevention of unauthorised access to, or use of personal data.

(2) Without prejudice to sub-regulation (1), the employer shall ensure that such personal data is processed solely for the purpose of administering the miscarriage leave and in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data

Protection Regulation) and the Data Protection Act, including the regulations made thereunder.

(3) Access to such personal data shall be strictly limited to persons who, by reason of their duties, are directly involved in the administration of miscarriage leave and the employer shall ensure that such persons are bound by an obligation of confidentiality.