A person employed with a Community institution or body and any Community institution or body itself acting as processor, with access to personal data, shall not process them except on instructions from the controller, unless required to do so by national or Community law.