S.L. 586.8 Art. 25Logging.

(1) Controllers, and where applicable processors, shall ensure that processing operations in automated processing systems relating to at least collection, alteration, consultation, disclosure including transfers, combination and erasure are logged.

(2) The logs referred to in sub-regulation (1) shall include at least the date and time of such operations and, as far as possible, the identification of the user performing such processing operation:

Provided that the logs of consultation and disclosure shall also include the justification for such operations, and as far as possible, the identity of the recipients of such personal data other than the user.

(3) The logs shall be only used for verification of the lawfulness of processing, self-monitoring, ensuring the integrity and security of the personal data, and for criminal proceedings.

(4) The controller and the processor shall make the logs available to the Commissioner upon request.