S.L. 628.1 Art. 94Data protection. 

(1) Any processing of personal data conducted by the

Authority in its capacity of a controller in accordance with Article 4(7) 

of the Regulation (EU) 2016/679 of the European Parliament and of the

Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection

Regulation), shall fully comply with the provisions of Regulation (EU) 2016/679 and the Data Protection Act, including the regulations made thereunder and the fundamental rights and freedoms of the data subjects.

(2) The controller shall process personal data as necessary and required for the purpose of the performance of its functions and, or the exercise of any of its powers under these regulations.

(3) The processing of personal data shall be proportionate to the aim pursued and respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subjects.

(4) The controller, while taking into account the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of the data subjects, both at the time of the determination of the means for processing as well as at the time of the processing itself, shall implement appropriate technical and organisational measures, in an effective manner and shall integrate the necessary safeguards into the processing in order to protect the rights of the data subjects and to ensure a level of security appropriate to the risk.

(5) The access to personal data shall be reserved exclusively to duly designated officers of the controller on the basis of a role-base access control mechanism and subject to confidentiality and, or professional secrecy obligations, in order to prevent abuse, or unlawful access to, or disclosure of personal data.

(6) The data protection officer designated by the controller in accordance with Article 37(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) shall be involved and duly consulted in a timely manner on all matters in relation to the protection of personal data processed for the purpose of these regulations.

(7) For the purposes of ensuring and being able to demonstrate that the processing of personal data is performed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the controller shall implement the appropriate data protection policies, which policies shall be periodically reviewed and updated where necessary.

Part XX Appointment of Special Administrators