(31) Public authorities to whom personal data is disclosed in connection with their legal duty to perform a public function (such as tax authorities, customs authorities, financial analysis units, independent administrative bodies or financial market authorities regulating and supervising securities markets) should not be treated as recipients if the personal data they receive is necessary for them to carry out a specific procedure in the general interest in accordance with Union or Member State law. A request for disclosure of personal data made by such public authorities should always be in writing, should be justified, should be of an exceptional nature, should not concern the entire data set or lead to the merging of data sets. When processing personal data received, such bodies should comply with applicable data protection laws, in accordance with the purposes of the processing.
„Our employees do not keep passwords under the keyboard."
Are you sure about that?

