Article 40 — Protection of personal data

1. In processing personal data pursuant to this Regulation, the Authority, the European Parliament and the committee of independent eminent persons referred to in Article 16 shall comply with Regulation (EU) 2018/1725. For the purposes of the processing of personal data, they shall be considered data controllers in accordance with Article 3, point (8), of that Regulation. 2. In processing personal data pursuant to this Regulation, European political parties and European political foundations, Member States when exercising control over aspects relating to the financing of European political parties and European political foundations in accordance with Article 29, and the independent bodies or experts authorised to audit accounts in accordance with Article 28(1) shall comply with Regulation (EU) 2016/679 and with the national provisions adopted pursuant thereto. For the purposes of the processing of personal data, they shall be considered data controllers in accordance with Article 4, point (7), of that Regulation. 3. The Authority, the European Parliament and the committee of independent eminent persons referred to in Article 16 shall ensure that personal data collected by them pursuant to this Regulation are not used for any purpose other than to ensure the legality, regularity and transparency of the funding of European political parties and European political foundations and the membership of European political parties. They shall erase all personal data collected for that purpose at the latest 24 months after the publication of the relevant parts in accordance with Article 39. 4. The Member States and independent bodies or experts authorised to audit accounts shall use the personal data they receive only in order to exercise control over the financing of European political parties and European political foundations. They shall erase those personal data in accordance with applicable national law after transmission pursuant to Article 34. 5. Personal data may be retained beyond the time limits laid down in paragraph 3 or provided for by the applicable national law as referred to in paragraph 4 where such retention is necessary for the purposes of legal or administrative proceedings relating to the funding of a European political party or a European political foundation or the membership of a European political party. All such personal data shall be erased at the latest one week after the date of conclusion of the said proceedings by a final decision, or after any audits, appeals, litigation or claims have been disposed of. 6. The data controllers referred to in paragraphs 1 and 2 shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss, alteration or unauthorised disclosure or access, in particular where the processing of such data involves their transmission over a network, and against all other unlawful forms of processing. 7. The European Data Protection Supervisor shall be responsible for monitoring and ensuring that the Authority, the European Parliament and the committee of independent eminent persons referred to in Article 16 respect and protect the fundamental rights and freedoms of natural persons in the processing of personal data pursuant to this Regulation. Without prejudice to any judicial remedy, any data subject may lodge a complaint with the European Data Protection Supervisor if they consider that their right to the protection of their personal data has been infringed as a result of the processing thereof by the Authority, the European Parliament or that committee. 8. European political parties and European political foundations, the Member States and the independent bodies or experts authorised to audit accounts under this Regulation shall be liable in accordance with applicable national law for any damage they cause in the processing of personal data pursuant to this Regulation. The Member States shall, without prejudice to Regulation (EU) 2016/679, ensure that effective, proportionate and dissuasive sanctions are applied for infringements of this Regulation.