{
  "url": "https://openlegislation.uk/eu-decision-2016-1250/annex-II/division-III/division-11/division-e",
  "json_url": "https://openlegislation.uk/eu-decision-2016-1250/annex-II/division-III/division-11/division-e.json",
  "legislation": "eudn/2016/1250",
  "legislation_title": "Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document C(2016) 4176) (Text with EEA relevance) (revoked)",
  "legislation_url": "https://openlegislation.uk/eu-decision-2016-1250",
  "path": "annex/II/division/III/division/11/division/e",
  "kind": "division",
  "number": "e",
  "heading": "Remedies and Sanctions",
  "text": "The result of any remedies provided by the dispute resolution body should be that the effects of non-compliance are reversed or corrected by the organization, insofar as feasible, and that future processing by the organization will be in conformity with the Principles and, where appropriate, that processing of the personal data of the individual who brought the complaint will cease. Sanctions need to be rigorous enough to ensure compliance by the organization with the Principles. A range of sanctions of varying degrees of severity will allow dispute resolution bodies to respond appropriately to varying degrees of non-compliance. Sanctions should include both publicity for findings of non-compliance and the requirement to delete data in certain circumstances. Other sanctions could include suspension and removal of a seal, compensation for individuals for losses incurred as a result of non-compliance and injunctive awards. Private sector dispute resolution bodies and self-regulatory bodies must notify failures of Privacy Shield organizations to comply with their rulings to the governmental body with applicable jurisdiction or to the courts, as appropriate, and to notify the Department.",
  "extent": "E+W+S+N.I.",
  "status": "repealed",
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Decision revoked (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), Sch. 3 para. 1(o); 2020 c. 1, Sch. 5 para. 1(1)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2016/1250/annex/II/division/III/division/11/division/e",
    "retrieved_at": "2026-11-01T15:13:53.293736+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}