Processing and protection of personal data

1.   Without prejudice to Articles 98, 99 and 100, Member States and the Commission shall collect personal data for the purposes of carrying out their respective management, control, audit and monitoring and evaluation obligations under this Regulation and, in particular, those laid down in Title II, Chapter II, Title III, Chapters III and IV, Title IV and Title V, Chapter III, and for statistical purposes, and shall not process those data in a way that is incompatible with those purposes.
2.   Where personal data are processed for monitoring and evaluation purposes under Regulation (EU) 2021/2115, and for statistical purposes, they shall be made anonymous.
3.   Personal data shall be processed in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725. In particular, such data shall not be stored in a form which enables data subjects to be identified for longer than is necessary for the purposes for which those data were collected or for which they are further processed, taking into account the minimum retention periods laid down in the applicable Union and national law.
4.   Member States shall inform the data subjects that their personal data may be processed by national and Union bodies in accordance with paragraph 1 and that in this respect they enjoy the data protection rights provided by Regulations (EU) 2016/679 and (EU) 2018/1725.