A’ 137/29.08.2019 GOVERNMENT GAZETTE (a) to (d). Article 71 Distinction between personal data and verification of their identity (Αrticle 7 of the Directive) During processing, the controller shall distinguish, as far as possible, personal data based on facts from personal data based on personal assessments. To this end, the controller shall specify the evaluations based on personal assessments as such, insofar as it is feasible, in the context of such processing. It should also be possible to determine which public authority maintains the records on which the evaluation upon personal assessment is based. Article 72 Transmission procedure (Articles 7 and 9 of the Directive) 1. The controller shall take appropriate measures to ensure that personal data which are inaccurate or no longer up to date are not transmitted or otherwise made available. To that end, the controller shall, as far as possible, verify the quality of personal data before they are transmitted or made available, making a reasonable effort. The controller should also, as far as possible and reasonable, in all transmissions of personal data include necessary information enabling the recipient to assess the degree of accuracy, completeness and reliability of personal data, and the extent to which they are up to date. 2. Where the processing of personal data is subject to specific conditions as to the transmission of data, the transmitting authority shall inform the recipient of those conditions and the requirement to comply with them. The obligation to provide information may be fulfilled by marking the data accordingly. 3. The transmitting competent authority shall not apply the conditions set out in the previous paragraph to recipients in other Member States or to agencies, offices and bodies established pursuant to Chapters 4 and 5 of Title V of the TFEU other than those applicable to similar transmissions of data within the within the Greek territory. Article 73 Rectification and erasure of personal data and restriction of processing (Article 5 of the Directive) 1. The controller shall rectify inaccurate personal data. 2. The controller shall erase personal data without delay, if the processing is unlawful, and the data must be erased to comply with a legal obligation or it is no longer necessary for the controller to be aware of such data to perform his or her tasks. 3. Paragraphs 3 to 5 of Article 56 shall apply accordingly. The recipient shall also be informed whether or not inaccurate personal data have been transmitted or whether personal data have been transmitted unlawfully. 4. Without prejudice to the maximum time limits for storage or erasure laid down in legal provisions, the controller shall provide for the erasure of personal data or 3399 for a periodic review of the need for storing personal data and shall ensure compliance with those time limits based on set procedural regulations. Article 74 Logging (Article 25 of the Directive) 1. The controller and the processor shall keep logs in automated processing systems for at least the following processing operations: (a) collection, (b) alteration, (c) consultation, (d) disclosure including transfers; (e) combination and (f) erasure. 2. The logs of consultation and disclosure shall make it possible to establish the justification, date and time of such operations and, as far as possible, the identification of the person who consulted or disclosed personal data, and the identity of the recipients of such personal data. 3. The logs shall be used solely for verification of the lawfulness of data processing by the Authority and the data subject, as well as for self-monitoring, ensuring the integrity and security of the personal data, and for criminal proceedings. 4. The logs shall be deleted at the end of the year following the year in which they were created. 5. The controller and processor shall make the logs available to the Authority on request. SECTION V TRANSFERS OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS Article 75 General principles for transfers of personal data (Article 35 of the Directive) 1. Where all the other conditions for transfers of personal data laid down in this Chapter are met, the transfer of personal data to the authorities of third countries or international organisations may take place, where: (a) the authority or international organisation is competent for the purposes referred to in Article 43, and (b) the Commission has adopted a decision ensuring an adequate level of protection in the third country, a territory or one or more specified sectors within that third country, or the international organisation in question, or, in the absence of such a decision, appropriate safeguards have been provided or exist pursuant to the following Article or, in the absence of the above, derogations for specific situations apply pursuant to Article 77. 2. The transfer of personal data may not take place, in spite of an adequacy decision in accordance with the previous paragraph and although this is required by the public interest, if, in such case, the protection of the data subject’s fundamental rights and legitimate interests cannot be ensured when their data are processed by their recipient. The controller shall assess the level of protection