(19)To ensure the efficiency of the database and analysis of the information in it in order to be an effective tool in the fight against money laundering and terrorist financing, the EBA should be able to combine as part of its analysis information submitted to it in accordance with this Regulation with other information available on material weaknesses in individual financial sector operators that make them vulnerable to money laundering or terrorist financing and which the EBA acquires in carrying out its tasks within the scope of its mandate. To ensure its relevance, when the information combined contains personal data, such data should fall under the data categories listed in Annex II. Combining of personal data should be exceptional and such processing may serve only to achieving the purposes of the present Regulation. The data may need to be combined in order to (i) ensure the accuracy and completeness of data obtained from competent authorities or (ii) to enable the EBA to integrate into its database relevant information of the same nature as that transmitted by the competent authorities but obtained through another channel such as through its investigations into potential breaches of Union law pursuant to Article 17 of Regulation (EU) No 1093/2010. Information relating to suspicions of criminal offences or criminal convictions committed by a customer, a beneficial owner, a member of the management body or key function holder could be an indicator of a lack of honesty, integrity or ML/TF risks. This can be a significant cause or contributor to material weaknesses in a financial sector operator’s governance arrangements, fitness and propriety, holders of qualifying holdings, business model or activities. Therefore, the personal data specified in Annex II may include information related to suspicion or conviction for criminal offences. Only the data related to material weaknesses can be included in the database. Given that under this Regulation the material weaknesses relate only to significant failures in the compliance with any of the AML/CFT-related requirements, this ensures the processing of the data under the Regulation remain limited in scope to grave breaches of the AML/CFT-related requirements, and hence remain limited to what is necessary and proportionate. All the personal data processed for the implementation of this Regulation should be handled in accordance with the data protection framework of the Union, including the principles relating to the processing such as lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.