[No. 6.] Data Protection (Amendment) Act 2003. S.4 [2003.] Practitioners Act 1978, a registered dentist, within the meaning of the Dentists Act 1985 or a member of any other class of health worker or social worker standing specified by regulations made by the Minister after consultation with the Minister for Health and Children and any other Minister of the Government who, having regard to his or her functions, ought, in the opinion of the Minister, to be consulted; ‘medical purposes’ includes the purposes of preventive medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services. Security measures for personal data. 2C.—(1) In determining appropriate security measures for the purposes of section 2(1)(d) of this Act, in particular (but without prejudice to the generality of that provision), where the processing involves the transmission of data over a network, a data controller— (a) may have regard to the state of technological development and the cost of implementing the measures, and (b) shall ensure that the measures provide a level of security appropriate to— (i) the harm that might result from unauthorised or unlawful processing, accidental or unlawful destruction or accidental loss of, or damage to, the data concerned, and (ii) the nature of the data concerned. (2) A data controller or data processor shall take all reasonable steps to ensure that— (a) persons employed by him or her, and (b) other persons at the place of work concerned, are aware of and comply with the relevant security measures aforesaid. (3) Where processing of personal data is carried out by a data processor on behalf of a data controller, the data controller shall— (a) ensure that the processing is carried out in pursuance of a contract in writing or in another equivalent form between the data controller and the data processor and that the contract provides that the data processor carries out the processing only on and subject to the instructions of the data controller and that the data processor complies with obligations equivalent 16