Article 68 Processing and protection of personal dataF1

F2The relevant authority may collect personal data, in relation to the constituent nation, for the purposes of checking, controlling, monitoring, evaluating and auditing direct payments or for the purpose of complying with requirements laid down in international agreements. They shall not process this data in a way that is incompatible with those purposes.

Where personal data are processed for monitoring and evaluation purposes as referred to in F3paragraph 1, they shall be made anonymous and processed in aggregated form only.

Personal data shall be processed in accordance with F4Regulation (EU) 2016/679 and the Data Protection Act 2018. In particular, such data shall not be stored in a form which permits identification of data subjects for longer than is necessary for the purposes for which they were collected or for which they are further processed, taking into account F5any statutory minimum retention periods.

F6The relevant authority shall inform the data subjects that their personal data may be processed by F7UK bodies and bodies in the constituent nation in accordance with paragraph 1, and that in this respect they enjoy the rights set out in F8Regulation (EU) 2016/679 and the Data Protection Act 2018, respectively.

This Article shall be subject to Articles 111 to 114 of Regulation (EU) No 1306/2013.