If personal data are exchanged under the Agreement, the following additional provisions shall apply:
- a)The receiving authority may use such data only for the stated purpose and shall be subject to the conditions prescribed by the supplying authority; such use is also permitted, subject to the written consent required under Article 8, for the prevention and prosecution of serious crimes and for the purpose of addressing serious threats to public security;
- b)The receiving authority shall on request inform the supplying authority about the use of the supplied data and the results achieved thereby;
- c)Personal data may be supplied only to the responsible agencies. Any subsequent supply to other agencies may be effected only with the prior approval of the supplying authority;
- d)The supplying authority shall be obliged to take all reasonable care to ensure that the data to be supplied are accurate and that they are necessary for and proportionate to the purpose for which they are supplied. Any bans on data supply prescribed under applicable domestic law shall be observed. If it emerges that inaccurate data or data which should not have been supplied have been supplied, the receiving authority shall be informed of this without delay. That authority shall be obliged to correct or erase such data without delay;
- e)Upon application the person concerned shall be informed of the supplied data relating to him and of the use to which such data are to be put. There shall be no obligation to furnish this information if on balance it turns out that the public interest in withholding it outweighs the interest of the person concerned in receiving it. In all other respects, the right of the person concerned to be informed of the existing data relating to him shall be governed by the domestic law of the Contracting Party in whose sovereign territory the application for the information is made;
- f)The receiving authority shall bear liability in accordance with its domestic laws in relation to any person suffering unlawful damage as a result of supply of data pursuant to this Agreement. In relation to the damaged person, the receiving authority may not plead in its defence that the damage had been caused by the supplying agency;
- g)If the domestic law of the supplying authority provides, with respect to the personal data supplied, for erasure within a certain period of time, that authority shall inform the receiving authority accordingly. Irrespective of such periods, supplied personal data shall be erased once they are no longer required for the purpose for which they were supplied;
- h)The supplying and the receiving authority shall be obliged to keep official records of the supply and receipt of personal data;
- i)The supplying and the receiving authority shall be obliged to take effective measures to protect the personal data supplied against unauthorised access, unauthorised alteration and unauthorised disclosure.
