Cyber Security and Data Protection Act. (4) If it deems it fit, the Authority shall seek the views of affected data subjects or their representatives. PART X Whistleblowing 5 31 Whistleblower (1) The Authority shall establish rules giving the authorisation for and governing the whistleblowing system. (2) Rules established in terms of subsection (1) must preserve— (a) the principles of fairness, lawfulness and purpose of the processing; (b) the principles related to the proportionality on the limitation of the scope, accuracy of the data which will be processed; (c) the principle of openness and delivering an adequate system for the collection of personal information shall address— (i) the scope and purpose of the whistleblowing; (ii) the processing of reporting; (iii) the consequences of the justified and unjustified reporting; (iv) the way of exercising the rights of access, correction, deletion as well as the competent authority to which a request can be made; and (v) the third party who may receive data concerning the informer and the person who is implicated in the scope of the processing of the report; (vi) the technical and organisational rules; (vii) rules concerning the rights of the data subject by making clear that the right of access doesn’t allow to access to data linked to a third person without his or her express and written consent; and (viii) the method of notifying the Authority. 10 15 20 25 30 (3) The person who is implicated shall be informed as soon as possible of the existence of the report and about the facts which he or she is accused of in order to exercise the rights established in this Act. (4) The release of information to the person who is implicated may be withheld in exceptional circumstances. PART XI General Provisions 35 40 32 Regulations (1) The Minister may, in consultation with the Authority, make regulations providing for all matters which by this Act are required or permitted to be prescribed or which, in his or her opinion, are necessary or convenient to be prescribed for carrying out or giving effect to this Act. (2) Regulations referred to in subsection (1) may provide for the exercise of the rights referred to in sections 25 to 27 of the Act. 33 Offences and Penalties (1) Any member of staff of the Authority or any expert, contractor, sub17