Personal data collected for the purposes set out in Article 223(1) must not be processed in a way which is incompatible with those purposes.

Where personal data are processed for monitoring and evaluation purposes as referred to in Article 223(1), they shall be made anonymous and shall be processed in aggregated form only.

Personal data shall be processed in accordance with F2Regulation (EU) 2016/679 and the Data Protection Act 2018. In particular, such data shall not be stored in a form which permits identification of data subjects for longer than is necessary for the purposes for which they were collected or for which they are further processed, taking into account F3any statutory minimum retention periods.

F4The relevant authority shall inform the data subjects that their personal data may be processed F5by United Kingdom bodies and bodies in the constituent nation in accordance with paragraph 1 and that in this respect they enjoy the rights set out in, respectively, F6Regulation (EU) 2016/679 and the Data Protection Act 2018 .