Article 16

A public sector body, the Commission, the European Central Bank or a Union body having received data as a result of a public emergency must:

(a)have implemented technical and organisational measures ensuring the confidentiality and integrity of the requested data and the security of the data transfers, in particular personal data, and preserving the rights and freedoms of data subjects; and

(b)erase the data as soon as they are no longer necessary for the stated purpose and inform the data holder and individuals or organisations that received the data pursuant to Article 21(1) without undue delay that the data have been erased, unless archiving of the data is required in accordance with Union or national law on public access to documents in the context of transparency obligations.