Data security and data protection
Article 38
Member States shall take all appropriate measures to ensure the security of transmitted personal data and in particular to avoid unlawful or unauthorised access or disclosure, alteration or loss of personal data processed. Each Member State shall provide that the national supervisory authority or authorities designated pursuant to Article 28(1) of Directive 95/46/EC shall monitor independently, in accordance with its respective national law, the lawfulness of the processing, in accordance with this Regulation, of personal data by the Member State in question.