Where the purposes and means of such processing are laid down by European Union law or by the law of the Member States, the controller or the specific criteria for his or her appointment may be laid down in accordance with European Union law or the law of the Member States.</p> <p> <strong>