{
  "url": "https://openlegislation.uk/eu-decision-2016-1250/annex-II/division-III/division-8/division-e",
  "json_url": "https://openlegislation.uk/eu-decision-2016-1250/annex-II/division-III/division-8/division-e.json",
  "legislation": "eudn/2016/1250",
  "legislation_title": "Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document C(2016) 4176) (Text with EEA relevance) (revoked)",
  "legislation_url": "https://openlegislation.uk/eu-decision-2016-1250",
  "path": "annex/II/division/III/division/8/division/e",
  "kind": "division",
  "number": "e",
  "heading": "When Access May be Restricted",
  "text": "i..As organizations must always make good faith efforts to provide individuals with access to their personal data, the circumstances in which organizations may restrict such access are limited, and any reasons for restricting access must be specific. As under the Directive, an organization can restrict access to information to the extent that disclosure is likely to interfere with the safeguarding of important countervailing public interests, such as national security; defense; or public security. In addition, where personal information is processed solely for research or statistical purposes, access may be denied. Other reasons for denying or limiting access are:\n1..interference with the execution or enforcement of the law or with private causes of action, including the prevention, investigation or detection of offenses or the right to a fair trial;\n2..disclosure where the legitimate rights or important interests of others would be violated;\n3..breaching a legal or other professional privilege or obligation;\n4..prejudicing employee security investigations or grievance proceedings or in connection with employee succession planning and corporate re-organizations; or\n5..prejudicing the confidentiality necessary in monitoring, inspection or regulatory functions connected with sound management, or in future or ongoing negotiations involving the organization.\nii..An organization which claims an exception has the burden of demonstrating its necessity, and the reasons for restricting access and a contact point for further inquiries should be given to individuals.",
  "extent": "E+W+S+N.I.",
  "status": "repealed",
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Decision revoked (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), Sch. 3 para. 1(o); 2020 c. 1, Sch. 5 para. 1(1)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2016/1250/annex/II/division/III/division/8/division/e",
    "retrieved_at": "2026-11-01T15:13:53.293736+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}