A controller or processor, prior to carrying out automated processing, shall -
(a) evaluate the risks to the rights and freedoms of individuals arising from the processing concerned, and
(b) implement measures designed to -
(i) deny access to the processing equipment used for the processing to any person other than the persons authorised in that regard by the controller or processor, as the case may be,
(ii) prevent the reading, copying, modification or removal of the data media concerned, other than in so far as is authorised by the controller or processor, as the case may be,
(iii) prevent the input of personal data other than in so far as is authorised by the controller or processor, as the case may be,
(iv) prevent the inspection, modification or deletion of the data other than in so far as is authorised by the controller or processor, as the case may be,
(v) prevent the use of the automated processing system by persons using data communication equipment who are not authorised to d
…