FantasticSearch

1. In processing personal data pursuant to this Regulation, the Authority, the European Parliament and the committee of independent eminent persons established by Article 11 shall comply with Regulation (EC) No 45/2001. For the purposes of the processing of personal data, they shall be considered data controllers in accordance with point (d) of Article 2 of that Regulation.

2. In processing personal data pursuant to this Regulation, European political parties and European political foundations, Member States when exercising control over aspects relating to the financing of European political parties and European political foundations in accordance with Article 24, and the independent bodies or experts authorised to audit accounts in accordance with Article 23(1) shall comply with Directive 95/46/EC and with the national provisions adopted pursuant thereto. For the purposes of the processing of personal data, they shall be considered data controllers in accordance with point (d) of Article 2 of that Directive.

3. The Authority, the European Parliament and the committee of independent eminent persons established by Article 11 shall ensure that personal data collected by them pursuant to this Regulation are not used for any purpose other than to ensure the legality, regularity and transparency of the funding of European political parties and European political foundations and the membership of European political parties. They shall erase all personal data collected for that purpose at the latest 24 months after the publication of the relevant parts in accordance with Article 32.

4. The Member States and independent bodies or experts authorised to audit accounts shall use the personal data they receive only in order to exercise control over the financing of European political parties and European political foundations. They shall erase those personal data in accordance with applicable national law after transmission pursuant to Article 28.

5. Personal data may be retained beyond the time limits laid down in paragraph 3 or provided for by the applicable national law as referred to in paragraph 4 where such retention is necessary for the purposes of legal or administrative proceedings relating to the funding of a European political party or a European political foundation or the membership of a European political party. All such personal data shall be erased at the latest one week after the date of conclusion of the said proceedings by a final decision, or after any audits, appeals, litigation or claims have been disposed of.

6. The data controllers referred to in paragraphs 1 and 2 shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss, alteration or unauthorised disclosure or access, in particular where the processing of such data involves their transmission over a network, and against all other unlawful forms of processing.

7. The European Data Protection Supervisor shall be responsible for monitoring and ensuring that the Authority, the European Parliament and the committee of independent eminent persons established by Article 11 respect and protect the fundamental rights and freedoms of natural persons in the processing of personal data pursuant to this Regulation. Without prejudice to any judicial remedy, any data subject may lodge a complaint with the European Data Protection Supervisor if he or she considers that his or her right to the protection of his or her personal data has been infringed as a result of the processing thereof by the Authority, the European Parliament or the committee.

8. European political parties and European political foundations, the Member States and the independent bodies or experts authorised to audit accounts under this Regulation shall be liable in accordance with applicable national law for any damage they cause in the processing of personal data pursuant to this Regulation. The Member States shall ensure that effective, proportionate and dissuasive sanctions are applied for infringements of this Regulation, of Directive 95/46/EC and of the national provisions adopted pursuant thereto, and in particular for the fraudulent use of personal data.