S.L. 595.7 Art. 3APersonal data processed by other entities.

(1) In the performance of its functions and duties, the

Agency shall have the right to access and, or request from any person, public authority, agency, body or private entity, information including personal data pertaining to any applicant or any third party, which is limited to the extent necessary for the purposes of these regulations or any other law which are applicable to the functions and duties of the Agency, and to what is necessary and proportionate to the objectives pursued by the Agency.

(2) When making a request in accordance with sub-article (1), the Agency shall provide the purpose for such a request and the function being exercised by the Agency.

(3) Any personal data processed by the Agency shall fully comply with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and the Data Protection Act, including the regulations made thereunder and the fundamental rights and freedoms of the data subjects.

(4) Whilst taking into account the nature, scope, context and reason for processing, as well as the risks of varying likelihood and severity for the rights and freedoms of the data subjects, the Agency shall implement appropriate technical and organisational measures in an effective manner in order to ensure a level of security appropriate to the risk.

(5) The access to personal data shall be reserved exclusively to duly designated officers on the basis of a role-base access control mechanism and subject to confidentiality and, or professional secrecy obligations, in order to prevent abuse or unlawful access to, or disclosure of personal data.

(6) For the purpose of ensuring and to be able to demonstrate compliance with the principles relating to the processing of personal data, the Agency shall implement the appropriate data protection policies, which policies shall be periodically reviewed and updated where necessary.

(7) The data protection officer designated by the Agency in accordance with Article 37 of Regulation 2016/679/EC of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) shall be involved and duly consulted and in a timely manner on all issues relating to the protection of personal data processed for the purposes of these regulations or any other laws which are applicable to the functions and duties of the Agency.