15 Quality of the data (1) The data controller shall ensure that personal data processed is: (a) adequate, relevant and not excessive in relation to the purposes for which it is collected or further processed; (b) accurate and, where necessary, kept up-to-date; every reasonable step must be taken to ensure that data which is inaccurate or incomplete with respect to the purposes for which it is collected or for which it is further processed, is erased or rectified; (c) retained in a form that allows for the identification of data subjects, for no longer than necessary with a view to the purposes for which the data is collected or further processed. The Authority shall establish appropriate safeguards for personal data retained longer than permitted above for historical, statistical or scientific research purposes. (2) The data controller shall take all appropriate measures to ensure that personal data processed shall be accessible regardless of the technology used and ensure that the evolution of technology shall will not be an obstacle to the future access or processing of such personal data. (3) The controller shall ensure compliance with the obligations set out in Paragraphs (1) and (2) by any person working under his/her authority and any subcontractor. Draft Data Protection Bill Version 1.0 21