It should also specify: (i) that exchanges of personal data between the Agency and national offices must be carried out in compliance with applicable data protection law, in particular Regulation (EC) No 45/2001 as regards the processing by the Agency and Directive 95/46/EC as regards the processing by national offices; (ii) the purpose of such exchanges, in particular whether they bring additional purposes to the original ones of each database and portal, and if so, what is the legal basis for these additional purposes; and (iii) the types of data exchanged, the authorised recipients of the data, and the length of the retention of dat ...[+++]a in these IT systems,

clarify in a substantive provision whether the common or connected databases and portals planned under Article 52 and recital 37 involve the processing of personal data as well as their scope and purpose(s), in particular whether they bring additional purposes to the original ones of each database and portal, and if so, what is the legal basis for these additional purposes,

Such supplementary data are to be reported on a best estimate basis, and the supplementary data requirements specified in columns ‘H’, ‘H.1’ and ‘H.2’ of Tables 1, 2, 4 and 5 of Annex I (supplementary data referring to the government sector and its sub-sectors) are to be reported on a voluntary basis.

Member States intending to introduce additional data shall provide the Commission with detailed information on the type of additional data and the reasons for storing such data on the microchip.

Member States intending to introduce additional data shall provide the Commission with detailed information on the type of additional data and the reasons for storing such data on the microchip.

7. Special categories of data: where data revealing racial or ehtnic origin, political opinions, religious or philosophical beliefs or trade union memberships and data concerning health or sex life and data relating to offences, criminal convictions or security measures are processed, additional safeguards should be in place within the meaning of Directive 95/46/EC, in particular, appropriate security measures such as strong encryption for transmission or such as keeping a record of access to sensitive data.