This could be a "central register". Article 8(1) of the Personal Data Protection Act provides that "central registers relating to persons suspected of illegal activities, criminal and administrative offences and decisions applying penalties, security measures, fines and additional penalties may only be created and kept by public services vested with that specific responsibility by a legal provision or a statutory regulation with organizational nature, subject to observance of procedural and data protection rules in force." Therefore, normally an ordinary institution is not authorized to keep such a register. Besides, the manner (central register) in which the Certificate of Criminal Record is kept in the case in question may seriously affect the interests of the data subjects, and as such may be against the principle of proportionality. Therefore, the PDPB holds that, for managerial purposes, while it suffices to have the Certificate of Criminal Record filed separately in the employee's dossier, the Record should not be kept in a consolidated cabinet.