The Commission may by regulation prescribe types of personal data and processing that may be exempted from application of this Act.