In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

(a) The purposes of the processing or categories of processing;

(b) The categories of personal data;

(c) The scope of the restrictions introduced;

(d) The safeguards to prevent abuse or unlawful access or transfer;

(e) The specification of the controller or categories of controllers;

(f) The storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

(g) The risks to the rights and freedoms of data subjects; and

(h) The right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.