{
  "url": "https://openlegislation.uk/eu-decision-2016-1250/annex-II/division-III/division-8/division-b",
  "json_url": "https://openlegislation.uk/eu-decision-2016-1250/annex-II/division-III/division-8/division-b.json",
  "legislation": "eudn/2016/1250",
  "legislation_title": "Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document C(2016) 4176) (Text with EEA relevance) (revoked)",
  "legislation_url": "https://openlegislation.uk/eu-decision-2016-1250",
  "path": "annex/II/division/III/division/8/division/b",
  "kind": "division",
  "number": "b",
  "heading": "Burden or Expense of Providing Access",
  "text": "i..The right of access to personal data may be restricted in exceptional circumstances where the legitimate rights of persons other than the individual would be violated or where the burden or expense of providing access would be disproportionate to the risks to the individual's privacy in the case in question. Expense and burden are important factors and should be taken into account but they are not controlling factors in determining whether providing access is reasonable.\nii..For example, if the personal information is used for decisions that will significantly affect the individual (e.g., the denial or grant of important benefits, such as insurance, a mortgage, or a job), then consistent with the other provisions of these Supplemental Principles, the organization would have to disclose that information even if it is relatively difficult or expensive to provide. If the personal information requested is not sensitive or not used for decisions that will significantly affect the individual, but is readily available and inexpensive to provide, an organization would have to provide access to such information.",
  "extent": "E+W+S+N.I.",
  "status": "repealed",
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Decision revoked (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), Sch. 3 para. 1(o); 2020 c. 1, Sch. 5 para. 1(1)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2016/1250/annex/II/division/III/division/8/division/b",
    "retrieved_at": "2026-11-01T15:13:53.293736+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}