S.L. 595.14 Art. 12Data protection.

(1) The applicability of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and of the Data Protection Act including all the regulations made thereunder and the fundamental rights and freedoms of data subjects shall not be prejudiced by this order.

(2) Where the processing of data is being conducted by any of the devices referred to in article 6A, the Agency in its function as data controller, shall implement visible notices, which may include inter alia, badges worn on, or next to the device, to ensure that the data subjects are informed of the processing operation at the time of collection of the data. The Agency shall provide the data subjects with all the relevant information referred to in Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

(3) The Agency shall ensure that the recordings processed by means of any of the devices referred to in article 6A are processed strictly for the purposes stipulated in the said article. Where the personal data is no longer necessary for the purposes for which the personal data is processed, the controller shall erase the personal data without undue delay.

(4) Where the Agency retains the recordings obtained in accordance with article 6A and such recordings contain personal data of natural persons that are not necessary for the purposes of the processing, the controller shall seek to blur out or anonymise such personal data, where possible and to the extent that such measure does not degrade the quality or usefulness of the data, and to the extent that such measure does not create a reasonable likelihood of rendering impossible or seriously impairing the achievement of the purposes of the processing.

(5) The Agency shall, after taking into account the status, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, implement the appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by the processing activity.

(6) The Agency shall grant access to recordings obtained by means of the devices referred to in article 6A solely to personnel duly authorised by the Chief Executive Officer and in accordance with a strict role-based access control mechanism.

(7) The Agency shall implement an internal policy to instruct the community officers on the appropriate use of the devices referred to in article 6A in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), specifying when and how these devices shall be used by community officers in the performance of their duties.

(8) The data protection officer designated by the Agency shall be involved and consulted in a timely manner on all issues in relation to the protection of personal data processed by the Agency.