S.L. 483.6 Art. 16Protection of personal data, confidentiality and security of processing. Cap. 586. Cap. 586. Cap. 586. Cap. 586 Cap.586.

(1) Procurement organisations and transplant centres shall ensure that the fundamental right to protection of personal data is fully and effectively protected in all organ donation and transplantation activities, in conformity with the provisions on the protection of personal data laid down in the Data Protection Act.

(2) Procurement organisations and transplant centres shall take all necessary measures to ensure that:

(a) the data processed are kept confidential and secure in accordance with the provisions of Data Protection Act;

(b) donors and recipients whose data are processed within the scope of these regulations are not identifiable, except as permitted by the provisions of the Data

Protection Act;

(c) the principles relating to data quality, as set out in the provisions of the Data Protection Act, are met.

(3) Procurement organisations and transplant centres shall ensure that:

(a) data security measures are in place, as well as safeguards against any unauthorised data additions, deletions or modifications to donor files or deferral records, and transfer of information;

(b) procedures are in place to resolve data discrepancies;

(c) no unauthorised disclosure of information occurs, whilst guaranteeing the traceability of donations;

(d) the identity of any recipient is not disclosed to the donor or his family and vice-versa;

(e) the information which is collected for the purposes of these regulations is held securely to ensure that -

(i) the information is available for the purpose of tracing donations;

(ii) the information is only disclosed in accordance with an order by the courts, upon request by the Licensing Authority or as permitted by law.

(4) The medical director responsible for the procurement organisation or the transplantation centre shall ensure that the results of the donor evaluation and testing procedures are documented and any major anomalies are reported to the Licensing Authority.

(5) Any unauthorised accessing of data or systems that makes identification of donor or recipients possible shall be punishable in accordance with regulation 20.

(6) Any use of systems or data that makes the identification of donors or recipients possible with a view to tracing donors or recipients other than for the purposes permitted by the Data Protection Act, or as provided in these regulations, shall be punishable in accordance with regulation 20 of these regulations.