A’ 137/29.08.2019 GOVERNMENT GAZETTE Article 58 Right to lodge a complaint with the Authority (Article 17 of the Directive) 1. The data subject shall have the right to lodge a complaint with the Authority, if the data subject considers that the processing of personal data relating to him or her by public authorities for the purposes referred to in Article 43 infringes his or her rights. This shall not apply to the processing of personal data by the judicial and prosecutorial authorities when processing such data acting in their judicial capacity. The Authority shall inform the data subject of the progress and the outcome of the complaint and of the possibility of bringing an action for annulment before the Council of State against the decision on his or her complaint, in accordance with Article 20. 2. Where a complaint relating to processing is lodged with the Authority instead of the competent supervisory authority of another Member State of the European Union, the Authority should transmit without delay to the supervisory authority of the other Member State of the European Union the complaint falling within its competence. In such a case, the Authority shall inform the data subject of the transmission of his or her complaint and provide him or her with any assistance upon his or her request. Article 59 Rights of the data subject in criminal investigations and proceedings (Article 18 of the Directive) In the context of criminal investigations and proceedings, the right to be informed of the processing, to access, rectification or erasure and restriction of personal data, in accordance with the provisions of Articles 54 to 56, shall be exercised in accordance with the provisions of the Code of Criminal Procedure, specific procedural provisions and the Code of court organisation and status of judicial officials, as applicable each time. SECTION IV OBLIGATIONS OF CONTROLLERS PROCESSORS AND Article 60 Processor (Articles 22 and 23 of the Directive) 1. Where processing is carried out on behalf of a controller, the controller shall ensure compliance with the obligations arising from this Law and other provisions relating to the protection of personal data. The right of the data subject to be informed, to rectification, erasure and restriction of the processing of personal data, as well as the right to compensation in this case shall be exercised vis-àvis the controller. 2. The controller shall be allowed to assign the processing of personal data only to processors who ensure that, by implementing appropriate technical and organisational measures, processing is carried out in accordance with the law and that the protection of the rights of the data subject is guaranteed. 3395 3. The carrying out of processing by a processor should be governed by a contract or other legal act binding the processor to the controller and that sets out the subject matter, duration, nature and purpose of the processing, the categories of data subjects and the rights and obligations of the controller. That contract or other legal act shall stipulate, in particular, that the processor: (a) acts only on instructions from the controller; where the processor is of the opinion that an instruction is unlawful, the processor should inform the controller without delay; (b) guarantees that persons authorised to process the personal data have pledged themselves to confidentiality to the extent that they are not under a valid statutory obligation of confidentiality; (c) assists the controller by any appropriate means to safeguard the data subject's rights; (d) at the controller’s discretion, returns or deletes all the personal data after the end of the provision of data processing services, and deletes existing copies, unless there is a legal obligation to store the data; (e) provides to the controller all information necessary to demonstrate compliance with his or her obligations, in particular logs created in accordance with Article 74; (f) allows audits to be carried out by the controller or the auditor authorised by the controller, and contributes to such audits; (g) takes all necessary measures in accordance with Article 62; (h) taking into account the nature of the processing and the information available, assists the controller to ensure compliance with the obligations laid down in Articles 62 to 65 and 67. 4. In the event that the processor engages another processor, the processor should impose the same obligations laid down in the contract with the controller, in accordance with paragraph 3, which also applies to the processor, unless these obligations are already binding on the other processor under other provisions. 5. The processor may engage another processor only with prior written authorisation from the controller. Where the controller has given general authorisation to the processor for the participation of another processor, the processor shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes. 6. The contract referred to in paragraph 3 shall be in writing or in electronic form. 7. A processor who determines, in infringement of this Article, the purposes and means of processing shall be considered to be a controller. Article 61 Joint controllers (Article 21 of the Directive) 1. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers. The duties and responsibilities of each joint controller shall be determined in a transparent manner, by means of a written arrangement, to the extent that their