9. Section 33 of the Principal Act is amended—

(a) in subsection (1)—

(i) by the insertion of the following paragraph after paragraph (b):

“(ba) the Competition and Consumer Protection Commission;”,

and

(ii) by the insertion of the following paragraph after paragraph (d):

“(da) an intermediary service provider;”,

(b) in subsection (2)—

(i) by the insertion of the following paragraph after paragraph (b):

“(ba) in the case of subsection (1)(ba), where the Commission considers that the disclosure is necessary and proportionate—

(i) for the effective implementation of the Digital Services Regulation, or

(ii) for the purposes of transferring a complaint or part of a complaint to the Competition and Consumer Protection Commission, where a complaint, or part of a complaint made under section 201 relates to a failure to comply with the Digital Services Regulation;”,

and

(ii) by the insertion of the following paragraph after paragraph (d):

“(da) in the case of subsection (1)(da), where the Commission considers that a complaint, or part of a complaint, made under section 201 is made in relation to an intermediary service provider, and the Commission considers that the disclosure is necessary and proportionate for the purposes of considering a complaint or part of a complaint made under that section;”,

(c) by the insertion of the following subsections after subsection (3):

“(3A) Where the Commission processes or discloses special categories of personal data in accordance with this section, it shall only do so where the Commission considers that the disclosure is necessary and proportionate in accordance with the Data Protection Regulation and the Act of 2018.

(3B) The Minister may make regulations prescribing suitable and specific measures for the processing of special categories of personal data under this section.

(3C) Where personal data processed by the Commission is required for the purposes of the prevention, investigation, detection or prosecution of a criminal offence, the data—

(a) may be processed for as long as it is required for such prevention, investigation, detection or prosecution, and

(b) shall be permanently deleted after it is no longer required for such prevention, investigation, detection or prosecution.”,

and

(d) by the insertion of the following subsection after subsection (9):

“(10) In this section—

‘Act of 2018’ means the Data Protection Act 2018;

‘special categories of personal data’ has the same meaning as it has in the Act of 2018;

‘suitable and specific measures’ means measures to be taken to safeguard the fundamental rights and freedoms of data subjects in processing the personal data of those data subjects and may include measures specified in section 36(1) of the Act of 2018.”.