(2) Without prejudice to the generalities of sub-Article (1) of this Article, the Commissioner shall: (a) exercise the powers and functions of the Commission specified under Article 5 of this Proclamation; (b) prepare the annual work plan and budget of the Commission, and utilize same when approved; (c) effect expenditures in accordance with the approved work budget and plan of the Commission; (d) represent the Commission in all dealings with third parties; (e) prepare the activity and financial reports of the Commission; and (f) organize the Commission, and hire and administer employees of the Commission in accordance with civil servants laws. 13. Powers and Functions of the Deputy Commissioners The Deputy Commissioners shall have the following duties: (1) perform the activities assigned to them by the Commissioner; (2) the deputy commissioner delegated by the Commissioner performs the activities of the Commissioner in his absence. 14. (1) (2) Oath and Confidentiality The Commissioner and Deputy Commissioners shall take an oath at the time of their appointment. A person who is or has been a Commissioner, a Deputy Commissioner, a member of Commission’s staff or an agent of the Commission shall not make use of or divulge, either directly or indirectly, any data obtained as a result of the exercise of a power or in the performance of a duty under this Proclamation, except: (a) in accordance with this or any other Proclamation; or (b) as authorized by the order of a Court CHAPTER THREE PROCESSING OF PERSONAL DATA 15. (1) (2) (3) The Principle of Lawfulness Personal data shall be processed lawfully. Notwithstanding the provision of sub-Article (1) of this Article, personal data shall not be processed unless there is compliance with at least one of the conditions set out in subArticles (3) and (4) of this Article; or in the case of sensitive personal data, Article 17 of this Proclamation. The processing of personal data shall meet the following conditions: (a) The data subject has given his consent; (b) Processing is necessary and is related to the fulfillment of a contract with the data subject or in order to take steps at the request of the data subject prior to entering 8