Article 12

1.          Any person acting under the authority of the responsible party or of the processor, as well as the processor himself, tothe extent that they have access to personal data, shall process these only on the instructions of the responsible party, subject to any differing statutory obligations.

2.          The persons, referred to in the first paragraph, who are not already subject to confidentiality obligations pursuant to their office, profession or any statutory requirement are required to protect the confidentiality of the personal data of which they become aware, subject to any statutory obligation to report these or the need to report arising from their task. Article 285 of the Criminal Code does not apply.