Article 16 Data Protection

The communication of personal data shall only take place if such communication is necessary for the implementation of this Agreement by the competent authorities of the former Yugoslav Republic of Macedonia or a Member State as the case may be. The processing and treatment of personal data in a particular case shall be subject to the domestic laws of the former Yugoslav Republic of Macedonia and, where the controller is a competent authority of a Member State, to the provisions of Directive 95/46/EC^f1 and to the national legislation of that Member State adopted pursuant to this Directive. Additionally the following principles shall apply:

1. (a)

   personal data must be processed fairly and lawfully;

2. (b)

   personal data must be collected for the specified, explicit and legitimate purpose of implementing this Agreement and not further processed by the communicating authority nor by the receiving authority in a way incompatible with that purpose;

3. (c)

   personal data must be adequate, relevant and not excessive in relation to the purpose for which they are collected and/or further processed; in particular, personal data communicated may concern only the following:

   • the particulars of the person to be transferred (e.g. given names, surnames, any previous names, other names used/by which known or aliases, sex, civil status, date and place of birth, current and any previous nationality),

   • passport, identity card or driving licence (number, period of validity, date of issue, issuing authority, place of issue),

   • stop-overs and itineraries,

   • other information needed to identify the person to be transferred or to examine the readmission requirements pursuant to this Agreement.

4. (d)

   personal data must be accurate and, where necessary, kept up to date;

5. (e)

   personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the data were collected or for which they are further processed;

6. (f)

   both the communicating authority and the receiving authority shall take every reasonable step to ensure as appropriate the rectification, erasure or blocking of personal data where the processing does not comply with the provisions of this article, in particular because those data are not adequate, relevant, accurate, or they are excessive in relation to the purpose of processing. This includes the notification of any rectification, erasure or blocking to the other Party;

7. (g)

   upon request, the receiving authority shall inform the communicating authority of the use of the communicated data and of the results obtained therefrom;

8. (h)

   personal data may only be communicated to the competent authorities. Further communication to other bodies requires the prior consent of the communicating authority;

9. (i)

   the communicating and the receiving authorities are under an obligation to make a written record of the communication and receipt of personal data.