Article 13 - Confidentiality

Any person acting under a Data Controller or a Data Processor, including the Data Processor himself, who has access to Personal Data must not process it except on instructions from the Data Controller, unless he is required to do so by law.