The processor and any person acting under the authority of the EPPO or of the processor, who has access to operational personal data, shall not process those data except on instructions from the EPPO, unless required to do so by Union law or the law of a Member State of the European Union.