ImplementingRegulationPersonalDataProtectionLaw

1- Disclosure of data collected from publicly available sources under paragraph (2) of Article 15 of the Law is allowed under the condition that such data have not been made available to the public in violation of the provisions of the Law and its Regulations. 2- Except for the circumstances provided in paragraphs (3) and (4) of Article 15 of the Law, the Controller shall consider the following when disclosing Personal Data: a) Disclosure request is closely related to a specific and clear purpose or subject. b) Necessary care shall be provided to protect the privacy of the Data Subject or any other individual. c) Disclosure is limited to the minimum amount of Personal Data necessary to achieve the purpose. 3- When disclosing Personal Data in response to a request from a public authority for security purposes, or to fulfil requirements of another law, or to fulfil judicial requirements, or if the disclosure is necessary to protect public health or public safety, or to protect the life of specific individuals' or their health, the following measures shall be taken: a) Document the request for Disclosure. b) Accurately identify the type of Personal Data required to be disclosed. Public 4. Except as provided in paragraphs (3) and (4) of Article 15 of the Law, when disclosing Personal Data related to another person who is not the Data Subject, the Controller shall take necessary care and provide sufficient guarantees to ensure the privacy of the other individual is preserved and not violated. This includes considering the following steps: a) In each separate case, balancing between the rights of the Data Subject and the rights of the other person. b) Whenever possible, pseudonymisation of Personal Data allowing the identification of the other person. 5. When disclosing Personal Data to achieve a Legitimate Interest for the Controller, the Controller shall comply with the provisions of Article 16 of this Regulation. 6. The Controller shall include Disclosure operations in the records of Personal Data Processing activities, document the dates, methods, and purposes of Disclosure.