Protection of personal data
Article 20
When implementing this Directive, Member States shall ensure that personal data are protected and may only be processed in accordance with Council Framework Decision 2008/977/JHA ( 17 ) and the principles of the Council of Europe Convention for the protection of Individuals with regard to the Automatic Processing of Personal Data of 28 January 1981 and its Additional Protocol. Access to such data shall be restricted, without prejudice to the rights of the data subject. Only authorised persons may have access to such data.