(1) Persons employed by registration authorities or other bodies acting on their behalf are prohibited from processing personal data without authorisation.
(2) When taking up their duties, the persons referred to in subsection (1) are to be informed by their employer of their obligations under subsection (1) and are to agree in writing to maintain the confidentiality of registration data. Their obligations continue after their employment ends.