legislative provisions. 19. Data officer: the body responsible for undertaking the public responsibility which generated the data of public interest that must be disclosed through electronic means, or during the course of operation in which this data was generated. 20. Data publisher: the body responsible for undertaking the public responsibility which uploads the data sent by the data control officer, if this officer has not published the data. 21. Data set: total data controlled in a single file. 22. Third party: any natural or legal person, or organisation without legal personality other than the data subject, the data controller or the data processor. 23. EEA State: any Member State of the European Union and any State which is party to the Agreement on the European Economic Area, as well as any State the nationals of which enjoy the same legal status as nationals of States which are parties to the Agreement on the European Economic Area, based on an international treaty concluded between the European Union and its Member States on the one hand and the State which is not party to the Agreement on the European Economic Area on the other hand. 24. Third country: any State that is not an EEA State. CHAPTER 2 PROTECTION OF PERSONAL DATA 4. Principles of Data Control Section 4 (1) Personal data may exclusively be controlled for a specific purpose to realize rights and fulfill obligations. Data control must at every stage comply with the objective of the data control; data must be recorded and controlled in a fair and legal manner. (2) Only personal data essentially needed to satisfy the aim of the control, appropriate for achieving the goal may be controlled. Personal data may only be controlled to the extent and for the time required to achieve the goal. (3) Throughout the data control process, personal data shall be classified as such until its connection with the data subject can be restored. The connection with the data subject can be restored if the data controller has the technical conditions required for restoration at his or her disposal. (4) It has to be ensured during the course of control that the data are accurate, complete and – if required for the data control – updated, and that the data subject is only identifiable for the time required for the data control. 5. Legal Basis of Data Control Section 5 (1) Personal data may be controlled if a. the data subject agrees to it, or b. it is provided for by law or – on the grounds of authorisation of law, within the scope defined in that law – by or pursuant to a local government decree for a purpose based on public interest (hereinafter mandatory data control). (2) Special data may be controlled in cases listed in Section 6 or if a. the data subject agrees to it in writing; b. this is necessary to implement an international treaty adopted within the framework of a law in the case of data listed in Section 3 Subsection 3.a), or is provided for by law to enforce basic rights ensured in the Fundamental Law, serves the interests of national security,