S.L. 583.12 Art. 3Data Retention Period.

(1) The Authority may retain all data, including any personal data, collected or otherwise processed in the pursuit of its regulatory functions under the Act for a period of ten years from the date when the data is no longer necessary in relation to the purposes for which it is collected or otherwise processed:

Provided that the retention of data, including any personal data, is ipso jure considered to be necessary in relation to the purposes for which it is collected or otherwise processed, throughout the duration of the validity of any authorisation issued by the Authority.

(2) Retention of the data, including any personal data, by the Authority for further periods shall be lawful when it is necessary:

(a) for compliance with a legal and, or regulatory obligation imposed on the Authority;

(b) for archiving purposes in the public interest, scientific and, or historical research purposes and, or statistical purposes; and, or

(c) for the establishment, exercise, and, or defence of legal claims by the Authority.

(3) The Authority shall process the data in a lawful, fair and transparent manner, particularly where the data constitutes personal data. The Authority shall process all personal data in accordance with data protection and privacy legislation.