S.L. 595.18 Art. 10Processing of personal data.

(1) The applicability of Regulation (EU) 2016/679 and the

Data Protection Act, including any regulations made thereunder and the fundamental rights and freedoms of the data subjects shall not be prejudiced by this order.

(2) When the Agency is acting in its capacity of a controller in terms of Article 4(7) of the Regulation (EU) 2016/679 shall perform the relevant data processing operations which are strictly necessary for the purposes of this order.

(3) Where the personal data communicated or otherwise made available to the Agency by virtue of this order or any other law in the performance of its functions, includes data other than that required for the purposes for which such data was communicated or otherwise made available to, the Agency shall immediately erase such data upon receipt.

(4) The processing of personal data, including special categories of personal data, for the purposes of this order shall be in conformity with the provisions of Article 5 of Regulation (EU) 2016/679, and the said personal data shall not be further processed in a manner that is incompatible with the purposes of this order.

(5) The processing of personal data for research and statistical purposes shall be subject to appropriate safeguards pursuant to Regulation (EU) 2016/679 for the rights and freedoms of the data subjects:

Provided that the said safeguards shall ensure that the appropriate technical and organisational measures are implemented in particular to ensure compliance with the principle of data minimisation as established in Article 5(1)(c) of Regulation (EU) 2016/679, which measures may include pseudonymisation.