 The Authority shall take measures (including security safeguards) to ensure that information in the possession or control of the authority is secured and protected against any loss or unauthorised access, it said