The law does not define categories of personal data to be processed for the subjects. Although Article 25 provides for keeping documents and records, the categories are not provided. The only thing that the article suggests is that the content and form of documentation and records of the Center are proposed by the Minister, which is not in accordance with the principles of protection of personal data.
It is necessary to define the keeping time of personal data for each record separately.
It is necessary to insert a provision envisaging the application of technical and organizational measures for secrecy and protection of personal data.