Below is an instruction that describes a task, writes a response that appropriately completes the request, the input will be given in the following.### Instruction:
Given a text of a GDPR Article. A norm defines the expected behavior and actions of involved parties in processing personal data in the GDPR Article. A single GDPR article can contain multiple norms, where each norm can contains multiple antecedents. Extract the norms and antecedents as much as you want depending on the complexity of the GDPR article. You must follow the rules that each norm extracted is elated to protect personal data and classify each norm according to the following categories: commitment, prohibition, authorization, or power. If the Article references other articles or paragraph or subgraph, incorporate relevant information from those cross-referenced information provided in the input to fully understand and extract the norms. Use the following format for the response to the extracted norms:


1. **Norm Type**: <The type of norm 1, which can be: Commitment: The subject is committed to making the consequent true if the antecedent holds. Prohibition: The subject is prohibited from making the consequent true when the antecedent holds. Authorization: The subject is authorized to make the consequent true if the antecedent holds. Power: The subject is empowered to make the consequent true if the antecedent holds, which may involve changing existing norms.>

   - **Subject**: <The party to whom the norm applies>
   - **Object**: <The party regarding whom the norm applies>
   - **Antecedent**: <Condition that triggers the norm, specifying when the subject's action is required>
    - <Antecedent 1>
    - <Antecedent 2>
    ...
    - <Antecedent N>
   - **Consequent**: <The action or outcome that satisfies the norm>
...
N. **Norm Type**: <The type of norm N, which can be: Commitment: The subject is committed to making the consequent true if the antecedent holds. Prohibition: The subject is prohibited from making the consequent true when the antecedent holds. Authorization: The subject is authorized to make the consequent true if the antecedent holds. Power: The subject is empowered to make the consequent true if the antecedent holds, which may involve changing existing norms.>

   - **Subject**: <The party to whom the norm applies>
   - **Object**: <The party regarding whom the norm applies>
   - **Antecedent**: <Condition that triggers the norm, specifying when the subject's action is required>
    - <Antecedent 1>
    - <Antecedent 2>
    ...
    - <Antecedent N>
   - **Consequent**: <The action or outcome that satisfies the norm>
### Input:
GDPR article number: 10
GDPR article: Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1)(f) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. 
Cross-reference articles: Article 6(1)(f):Processing shall be lawful only if and to the extent that
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party,
except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data, in particular where the data subject is a child. 

The first subparagraph shall not apply to processing carried out by public authorities in the performance of
their tasks. 

first subparagraph:Processing shall be lawful only if and to the extent that
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party,
except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject
which require protection of personal data, in particular where the data subject is a child. 

### Response:
Norm: Norm Commitment
Subject: Data Controller
Object: Data Subject
Antecedent: 
-Processing of personal data relating to criminal convictions and offences or related security measures and
-Processing is necessary for the purposes of the legitimate interests
Consequent: 
-Processing of personal data under the control of official authority or
-Processing is authorised by
Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects

Norm Commitment
Subject: Third party
Object: Data Subject
Antecedent: 
-Processing of personal data relating to criminal convictions and offences or related security measures and
-Processing is necessary for the purposes of the legitimate interests 
Consequent: 
-Processing of personal data under the control of official authority or
-Processing is authorised by
Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects

Norm Commitment
Subject: Official authority 
Object: Data Controller
Antecedent: Processing of personal data relating to criminal convictions and offences or related security measures 
Consequent: Keeping the register without the control of official authority
