(b) outside national territory, but in a place where Portuguese law applies by virtue of international public law; (c) by a controller who is not established on European Union territory and who for purposes of processing personal data makes use of equipment, automated or otherwise, situated on Portuguese territory, unless such equipment is used only for purposes of transit through the territory of the European Union. 4 – This Act shall apply to video surveillance and other forms of capture, processing and dissemination of sound and images allowing persons to be identified, provided the controller is domiciled or based in Portugal or makes use of a computer or data communication network access provider established on Portuguese territory. 5 – In the circumstances referred to in paragraph 3 (c), the controller must designate, by means of notification to the Comiss�o Nacional de Protec�o de Dados (CNPD), a representative established in Portugal to replace him in all his rights and obligations, without prejudice to his own liability. 6 – The preceding number shall apply where the controller is covered by the status of extraterritoriality, immunity or any other status which precludes criminal proceedings. 7 – This Act shall apply to the processing of personal data regarding public safety, national defence and State security, without prejudice to special rules in instruments of international law to which Portugal is bound and specific laws pertinent to the respective sectors. (a) processed lawfully and with respect for the principle of good faith; (b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; (c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed; (d) accurate and, where necessary, kept up to date; adequate measures must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified; (e) kept in a form which permits identification of their subjects for no longer than is necessary for the purposes for which they were collected or for which they are further processed. 2 – The storing of data for historical, statistical or scientific purposes for longer periods than in (e) above may be authorised by the CNPD at the request of the controller in the case of a legitimate interest. 3 – It shall be for the controller to ensure that the above numbers are complied with. 5/20