S.L. 528.12 Art. 4Data protection. Cap. 586.

(1) Nothing in these regulations shall prejudice the applicability of Regulation 2016/679/EC and the Data Protection Act, including the regulations made thereunder, and the fundamental rights and freedoms of the data subjects.

(2) The Department in its capacity of a controller in terms of Article 4(7) of Regulation (EU) 2016/679 shall perform the relevant data processing operations which are limited to the extent necessary and proportionate to perform its functions and duties.

(3) Any personal data processed by the Department shall fully comply with all the principles relating to the processing of personal data pursuant to Article 5 of Regulation 2016/679/EC.

(4) The Department, whilst taking into account the nature, scope, context and purpose of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of the data subjects, shall implement appropriate technical and organisational measures, in an effective manner in order to ensure a level of security appropriate to the risks.

(5) For the purpose of ensuring and to be able to prove compliance with the principles relating to the processing of personal data, the Department shall implement appropriate data protection policies, which policies shall be reviewed and updated where necessary.

(6) The access to personal data shall be reserved exclusively to duly designated officers on the basis of a role-based access control mechanism and subject to confidentiality and, or professional secrecy obligations, in order to prevent abuse or unlawful access to, or disclosure of personal data.

(7) The data protection officer designated by the Department in terms of Article 37 of Regulation 2016/679/EC shall be involved and duly consulted and in a timely manner in relation to the protection of personal data processed for the purpose of these regulations.