The italian republic on police cooperation

08.06.2023

AGREEMENT

BETWEEN THE GOVERNMENT OF THE REPUBLIC OF UZBEKISTAN AND THE GOVERNMENT OF THE ITALIAN republic

[Registered in the State register of international treaties of the Republic of Uzbekistan on June 21, 2023. Registration No. 4515-IT-2023-H]

PREAMBLE

The Government of the Republic of Uzbekistan and the Government of the Italian Republic, hereinafter collectively referred to as the “Parties” and separately as a “Party”;

AWARE of the negative effects that crime in its various forms has on public order and security as well as on the welfare of their citizens;

ATTACHING great importance to the development of the international cooperation between police authorities in combating crime and terrorism ensuring the protection of human rights and freedoms;

WISHING to strengthen the friendly relations existing between their two countries, on the basis of the principles of equality and mutually beneficial cooperation;

RECALLING the Single Convention on Narcotic Drugs (New York, 30 March 1961), as amended by its additional Protocol (Geneva, 25 March 1972), the Convention on Psychotropic Substances (Vienna, 21 February 1971), the UN Convention on the Fight against the Illicit Traffic in Narcotic Drugs and Psychotropic Substances (Vienna, 20 December 1988), the UN Convention against Transnational Organized Crime (New York, 15 November, 2000) and its additional Protocol against the Smuggling of Migrants by Land, Sea or Air (New York, 15 November, 2000), the Protocol to Prevent, Suppress and Punish Trafficking in Persons, especially Women and Children (New York, 15 November, 2000), the UN Convention against Corruption (New York, 31 October 2003), and the Conventions against terrorism, adopted under the aegis of the United Nations, to which the Republic of Uzbekistan and the Italian Republic are parties, as well as the Global Action Plan (New York, 23 February 1990) and the UN General Assembly Resolution No. 45/123 on International Cooperation in Combating Organized Crime (New York, 14 December 1990);

HAVING REGARD TO the provisions under Article 72 of the Partnership and Cooperation Agreement establishing a partnership between the European Communities and their Member States, of the one part, and the Republic of Uzbekistan, of the other part, done at Florence on 21 June 1996;

HAVE AGREED as follows:

Article 1 AIMS

1. The aim of this Agreement is to promote, develop and strengthen cooperation to prevent and suppress crime, in all its serious and emerging forms, as well as terrorism.

2. This Agreement shall be implemented in accordance with applicable international law and, as for the Italian Party, the obligations arising from its membership of the European Union.

Article 2 COMPETENT AUTHORITIES

1. The competent authorities responsible for implementing this Agreement shall be the following:

a. For the Uzbek Party, the Ministry of the Internal Affairs;

b. For the Italian Party, the Ministry of the Interior.

Article 3 AREAS OF COOPERATION

1. The Parties shall cooperate in order to prevent and counter serious and emerging criminal phenomena and transnational crime in all its forms, with particular reference, but not limited to, the following sectors:

a. Transnational organized crime and corruption;

b. Activities of terrorist groups that are considered crimes, in accordance with the national legislation of both Parties or the relevant international Conventions that are binding upon both Parties, including activities aimed at financing the said terrorist groups;

c. Crimes against persons, in particular kidnapping and exploitation of prostitution;

d. Illegal production of and trafficking in narcotic drugs, or psychotropic substances and their chemical precursors, as well as base chemical substances used in their manufacture, medicines containing psychoactive principles and used for doping, New Psychoactive Substances (NPS);

e. Trafficking in persons, especially women and children as well as human organs and tissues, and smuggling of migrants and related crimes;

f. Illicit trafficking in weapons, ammunitions, explosives;

g. Cybercrime and online child pornography;

h. Economic and financial crimes, including money laundering;

i. Laundering and legalization of crime proceeds;

j. Property crimes, including crimes against historical and cultural heritages;

k. Environmental crimes;

l. Crimes relating to counterfeiting of money, payment cards and other payment documents and counterfeiting in general;

m. Transport crimes;

n. Other serious crimes.

2. With a view to preventing the commission of criminal offences, the competent Authorities shall also cooperate to guarantee:

a. public order and security, notably on the occasion of major events and social crises;

b. development of community policing;

c. road safety, security at airports, railways, subways as well as at tourist sites;

d. cooperation in the forensic sector;

e. cooperation in the canine sector;

f. identification of persons who, due to health or age reasons, are not able to report information about themselves, as well as of unidentified corpses;

g. information exchange on material, equipment and technologies used by Police Forces;

h. cooperation in the development of information and telecommunication systems;

i. cooperation in the field of basic, advanced and specialised training, also through the participation of police officers of either Party in the training courses and activities organized in the country of the other Party on themes of significant strategic interest.

3. This Agreement shall have no effect on extradition matters and on mutual legal assistance in criminal matters.

4. The competent Authorities may conclude technical arrangements, the provisions of which will specify the cooperation of the Parties in certain areas of the fight against crime.

Article 4 FORMS OF COOPERATION

1. The forms of cooperation under this Agreement shall include:

A) Exchange of information:

a. on crimes, organized criminal groups, structured groups and the persons involved in them, as well as their structure, management and modi operandi;

b. to search for fugitives;

c. on terrorist groups acting on the respective territories and the persons involved, as well as their modi operandi;

d. on natural and legal persons involved in trafficking of drugs, their precursors and chemical substances;

e. aimed at identifying and locating assets of illicit origin;

f. on irregular immigration;

g. on passports and other travel documents, visa and entry and exit stamps in order to detect counterfeit and forged documents;

h. to counter cybercrime, in particular child sexual exploitation and online child pornography;

i. exchange of other information of mutual interest for the competent authorities.

B) Analysis of criminal phenomena of common interest and sharing of operational tools and best practices, in particular:

a. on the management of seized and confiscated assets:

b. on drug trafficking in the respective countries, on new types of narcotic drugs or psychotropic substances, chemical precursors and related crimes as well as international trafficking in such substances, also through computer networks, and on the results of seized drug samplesʼ analyses;

c. on legislative and scientific tools to fight against crime, including investigation and scientific analysis techniques;

d. on techniques and operational practices to prevent and suppress criminal infiltration of companies participating in tenders for public works;

e. on methods used to counter trafficking in human beings and illicit trade in migrants;

f. on the identification and readmission of their citizens who are irregularly present on the territory of the other State with respect to immigration laws, with the possibility to develop an implementing protocol containing the operational procedures for better carrying out said cooperation.

C) Adoption of the necessary measures to coordinate the implementation of special investigation techniques such as controlled deliveries, electronic surveillance or other forms of surveillance, and undercover operations.

D) Execution of the requests for assistance envisaged by Article 5.

E) Strategic cooperation in:

a. training and good practices on police training;

b. exchange of experiences and experts;

c. organization of courses, training activities and joint events;

d. capacity building;

e. organization of visits, seminars, exchange of best practices;

f. exchange of information on legislative, scientific and technological instruments, on organization and management, on research and technological innovation, on the analysis of emerging security threats and the development of policies and strategies aimed at curbing them.

2. The competent authorities of the Parties will exchange lists of their contact points to comply with the provisions of this Agreement within thirty (30) calendar days after the entry into force of this Agreement.

Article 5 REQUEST FOR ASSISTANCE

1. Cooperation within the framework of this Agreement shall take place based on the request of the interested Party for assistance (hereinafter referred to as the “request”). Each Party may also forward the information available to the other Party without request, if there is reason to believe that such information is of interest to the other Party.

2. The request shall be sent in writing, including using technical means of transmitting text. In urgent cases, requests and information can be transmitted orally, but they shall be confirmed in writing, within the next three (3) days.

3. In case of doubt about the authenticity or content of the request, additional confirmation shall be requested.

4. The request must contain:

a. the name of the authority requesting assistance and the requested authority, if known;

b. a statement outlining the request, its purpose and justification;

c. any other information that may be used for the proper execution of the request.

5. The request is drawn up on the official departmental form and signed by an authorized official of the competent authority of the State of the requesting Party.

6. The Parties shall exchange lists of officials of their competent authorities authorized to sign requests, as well as samples of departmental forms. The Parties shall immediately notify each other of any change in the lists of officials authorized to sign the requests or in the official departmental forms.

Article 6 EXECUTION OF THE REQUEST FOR ASSISTANCE

1. The requested Party shall take all necessary measures to ensure the prompt and full execution of the request within thirty (30) calendar days. The requested Party shall immediately notify the requesting Party of circumstances that impede the execution of the request or significantly delay its execution.

2. If the execution of the request is not within the competence of the authority of the requested Party, the latter shall immediately notify the requesting Party and shall transfer it to the competent authority upon request.

3. The requested Party shall have the right to request additional information if it considers it necessary, for the proper execution of the request.

4. The execution of the request is carried out in accordance with the legislation of the State of the requested Party.

5. If the requested Party considers that the execution of the request may interfere with the criminal prosecution or proceedings carried out in its State related to a criminal case, it may postpone the execution of the request or associate its execution with the observance of the conditions recognized as necessary after consultation with the requesting Party. If the requesting Party agrees to the execution of the request under such conditions, it must comply with them.

6. The requested Party shall immediately inform the requesting Party of the results of the execution of the request.

Article 7 REFUSAL OF REQUEST FOR ASSISTANCE

1. A request may be refused in whole or in part if the requested Party believes that the execution of the request may damage the sovereignty, security, public order or other essential interests of its State, violate human rights and freedoms, or is contrary to the internal law or international obligations of its State.

2. Assistance may be refused if the act in connection with which the request was received is not a crime under the law of the State of the requested Party.

3. If possible, the requested Party shall consult with the requesting Party to consider whether assistance can be provided subject to the conditions that the requested Party considers necessary, prior to the decision to refuse assistance on the basis of paragraphs 1 and 2 of this Article. The requesting Party shall comply with the conditions on the basis of which it is assisted.

4. The requesting Party shall be notified in writing of a complete or partial refusal to execute the request indicating the reasons for the refusal.

Article 8 PERSONAL DATA PROCESSING

1. Personal data transferred pursuant to art. 4, point 1, letters A to D, of this Agreement and to the related Technical Arrangements referred to under art. 3, clause 4, are exclusively processed for the purposes provided for in art. 1 and in accordance with the clauses on their transfer contained in Annex 1, which forms an integral part of this Agreement.

2. In order to ensure the protection of the personal data of employees and collaborators of the other Party received for the implementation of this Agreement and of the related Technical Arrangements, each Party shall undertake not to transfer such data to third parties and, in any case, not to process them in a manner that is incompatible with the agreed purposes without the prior written consent of the other Party.

Article 9 JOINT GROUPS

1. For the purpose of implementing this Agreement and to evaluate and improve cooperation, the Parties shall set up a strategic cooperation joint committee with an equal number of representatives, which shall meet at least once a year, also by videoconference, to develop a plan of the joint actions to be undertaken and any other useful initiative to strengthen bilateral cooperation in combating crime.

2. In accordance with their national legislations, the competent authorities may also set up joint operational and investigation working groups acting according to the emerging operational needs and for limited periods of time, with, advisory, assistance and analysis tasks.

Article 10 CONSULTATIONS AND MEETINGS

The representatives of the competent authorities may hold meetings and consultations, also by means of videoconferences.

Article 11 COSTS

1. The ordinary expenses for the execution of the assistance requests shall be borne by the receiving competent Authority unless otherwise agreed upon in writing by both competent Authorities. Should the request for assistance include considerable or extraordinary expenses, the competent Authorities shall consult in order to establish the terms and conditions under which the request shall be processed and the way in which expenses shall be shared.

2. Unless otherwise decided by the competent Authorities, the costs of meetings shall be borne by the receiving competent Authority, whereas travel and accommodation costs shall be borne by the sending competent Authority.

3. The Parties may provide each other with gratuitous assistance, including equipment and materials necessary for solving the tasks of combating crime.

Article 12 WORKING LANGUAGES

1. For the purpose of the cooperation under this Agreement, the Parties shall use the Uzbek, Italian English languages.

2. Requests shall be sent in the official language of the requesting Party with obligatory translation into the official language of the requested Party or into English.

Article 13 SETTLEMENT OF DISPUTES

Any disputes arising from the interpretation or implementation of this Agreement shall be settled through direct consultations and negotiations between the Parties.

Article 14 CLAUSE OF COMPATIBILITY

The provisions of this Agreement do not affect the rights and obligations of the Parties arising from other international treaties to which they are Parties.

Article 15 FINAL PROVISIONS

1. This Agreement shall enter into force on the date of receipt of the last of the two written notifications of the Parties certifying the completion of their internal procedures necessary for the entry into force of this Agreement. This Agreement shall remain in force for an unlimited period of time, unless either Party notifies the other of its intention to terminate it at least 6 (six) months before the proposed date for its termination.

2. The Agreement between the Government of the Republic of Uzbekistan and the Government of the Italian Republic for the cooperation in the fight against organized crime, terrorism and the illicit trafficking in narcotic drugs and psychotropic substances, done at Rome on November 21, 2000, shall cease to have effect upon the entry into force of this Agreement.

3. The Parties, upon mutual written consent, may supplement or amend this Agreement. The supplements and amendments agreed upon constitute an integral part of this Agreement and shall enter into force according to the provisions of paragraph 1 of the present Article.

4. In the event of termination of this Agreement, its provisions shall continue to apply to all pending activities carried out in accordance with this Agreement.

In witness whereof the Undersigned, being duly authorised thereto, have signed this Agreement.

Done at Rome on the 8th of June, 2023, in two originals, each in the Uzbek, Italian and English languages, all texts being equally authentic.

In case of differing interpretations, the text in English shall prevail.

(signatures)

Annex

Regulations on the transfer of personal data

Taking into account the legislation of Uzbekistan and Italy, as well as the obligations of the Italian side arising from its membership of the European Union, in accordance with Article 2 of the Agreement between the Government of the Republic of Uzbekistan and the Government of the Italian Republic on Police Cooperation (hereinafter referred to as the Agreement), the "competent Authority" of each Party shall provide personal data to the other Party, applying the guarantees specified in the clauses of this Annex. Such guarantees are binding on the Parties and shall prevail over any conflicting obligations under their respective legislation.

I. Definitions

For the purposes of these Clauses:

(a) “Central competent Authority”: is the Authority/ies mentioned in the Agreement as point/s of contact to exchange information or the Authority/ies competent for its implementation.

(b) “other Authority”: is the public authority or body/entity tasked by the national regulations to exert public powers and authority for the purpose of prevention, investigation, identification and prosecution of crimes or of enforcing criminal sanctions, including protection from and prevention.

(c) “personal data": means any information recorded in electronic form, on paper and (or) on another tangible object that belongs to or allows the identification of a natural person.

(d) “subject of personal data": means a natural person to whom personal information belongs.

(e) “special data” is any personal data revealing the racial or ethnic origin, public opinions, religious or philosophical beliefs, the belonging to a trade union, genetic or biometric data intended to uniquely identify a natural person, including data relating to health and sexual life of any person.

(f) “judicial data”: is any personal data relating to criminal sentences and crimes or related security measures.

(g) “common data”: is any personal data that is not special or judicial.

(h) “processing”: is any operation or more operations on personal data, with or without the support of automated processes, like collection, registration, organization, structuring, storage, adaptation or modification, mining, consultation, using or communication through transmission, circulation or any other form of provisions like interconnection or comparison, limitation, deletion or destruction.

(i) “data transfer“: is the supplying of personal data from the Competent Authority of one Party to the Competent Authority of the other Party for law enforcement purposes, like crime prevention, public order and security protection and for judicial police purposes performed in compliance with the national legislation.

(j) “further communication”: is the supplying of personal data from the receiving Competent Authority to another Competent Authority in the same country of the Parties.

(k) “further transfer“ is the supplying of personal data from the receiving Competent Authority to another Competent Authority in a country other than the Partiesʼ or to an international Organization.

(l) “profiling”: is any automated processing of personal data consisting in using personal data to evaluate specific personal features relating to a natural person.

(m) ”violation of personal data“: is a security violation accidentally or illegally causing destruction, loss, modification, unauthorized circulation or access to transmitted, stored or in any way processed personal data.

(n) “applicable legal requirements”: is the legal framework in force applicable to each Authority, including personal data regulations.

(o) “Supervisory Authority”: is the independent public authority established at each Party (or: either Party) responsible for supervising the enforcement of the national legislation on personal data protection in criminal matters (or the alternative administrative mechanism set up at the other Party, able to ensure to Data Subjects an equivalent level of protection — to be adjusted on a case-by-case basis);

(p) “rights of the Data Subjects":

“right to receive information”: is the right of a Data Subject to receive information on the processing of personal data concerning him/her in a concise, transparent, intelligible and easily accessible form;

“right of access”: is the right of a Data Subject to obtain confirmation whether or not processing of personal data concerning him/her is under way and, in this case, to obtain access to his/her personal data and to the characteristics of the ongoing processing;

“right of correction”: is the right of a Data Subject to obtain the rectification or integration of the inaccurate personal data concerning him/her, without unjustified delay;

“right to delete” is the right of a Data Subject to obtain deletion of his/her personal data when this is no longer necessary with respect to the purposes for which it was collected or otherwise processed or when data was illegally collected or processed with respect to these Clauses and the applicable legal requirements;

“right to limitation on processing”: is the right of a Data Subject to limitation of the processing of his/her own personal data where such data is incorrect, the processing is unlawful or a Competent Authority does no longer need the personal data with regard to the purposes for which such data has been collected;

“right not to be subject to automated decisions, including profiling” is the right of a Data Subject not to be subject to a decision exclusively based on automated processing, including profiling, which may produce legal effects on him/her or have a similar significant impact on him/her.

(q) “limitations on the rights of Data Subjects”: means that the rights of Data Subjects referred to under clause (p) may be delayed, limited or denied insofar as, and for the period of time, this represents a necessary and proportionate measure, taking into account the fundamental rights and legitimate interests of the natural person concerned in order:

not to jeopardize the success of preventive, investigative, crime detection activities, prosecution of crimes or the imposition of penal sanctions, as well as the implementation of personal and property-related preventive measures and security measures;

to protect public security;

to protect national security;

to protect othersʼ rights and liberties.

(r) “limitations on the obligations of the Competent Authorities”: means that compliance with the obligation by the Competent Authority to provide a general report is subject to the limitations referred to under clause (q).

II. Scope

These Clauses apply to the transfer of personal data of natural persons presumed to be involved in criminal activities listed in art. 4, clause 1, letters A to D of the Agreement, which are necessary for the pursuit of the purposes provided for under art. 1 of the Agreement.

III. Guarantees for the protection of personal data

1. Limitations on purposes

Personal data shall be transferred between the Competent Authorities exclusively to achieve the purposes referred to in paragraph II of the Regulations. The Authorities shall not communicate or make further transfers of personal data for purposes other than those indicated above and shall take care to obtain appropriate guarantees so that subsequent processing is limited to the said purposes, taking into consideration what is indicated under clause 6, paragraph III of the Regulations.

2. Proportionality and quality of data

The transferring Competent Authority shall exclusively supply personal data that is adequate, relevant and limited to what is necessary with regard to the purposes for which it is transferred and subsequently processed.

The transferring Competent Authority shall ensure that, as far as it knows, the personal data it is transferring is correct and, if necessary, updated. If a Competent Authority becomes aware that the personal data it has transferred to another Authority is incorrect, it shall inform the receiving Competent Authority that shall make the necessary corrections.

3. Transparency

Each Competent Authority shall provide the Data Subjects with a general report about:

(a) the identity and contact data of the Person in charge of data processing and, if present, of the Responsible for data protection;

(b) the purposes and legal basis for personal data processing, as well as about the data retention period or the criteria for setting it;

(c) the categories of the recipients of personal data to whom said data may be sent in the form of communication or further transfer;

(d) the rights of the Data Subjects under these Clauses and in accordance with applicable legal requirements, including how these rights can be exercised;

(e) the right to file a complaint with a supervisory Authority, specifying the relevant contact data, as well as the right to apply to a judicial Authority;

(f) further information that is regarded as useful to exercise the above-mentioned rights, in particular in case the data has been collected unknown to the Data Subject;

(g) information about delays, limitations or exclusions provided for by applicable legal requirements with regard to the exercise of said rights.

Each Authority shall disseminate the aforesaid report through its own site, together with the Agreement. Copy of the report shall also be included in individual communications to the Data Subjects, as well as reference to the above site.

Compliance with the obligation by the Competent Authorities to provide a general report is subject to the limitations referred to under clause (q) paragraph III of the Regulations.

4. Security and confidentiality

Each Authority shall implement adequate technical and organizational measures to protect the personal data received from accidental or illegal access, destruction, loss, alteration or unauthorized dissemination. The said measures shall include adequate administrative, technical and physical security measures. These measures shall also include classification of personal data into common, particular and judicial data, limitations on subjects authorized to access personal data, secure personal data retention according to its type and the adoption of policies designed to ensure that personal data is kept secure and confidential, also by resorting to pseudonymization or encryption techniques. With regard to the management of particular and criminal data, the strictest security measures shall be implemented by providing for, inter alia, more selective accesses and specialist training for those dealing with this data.

If a receiving Competent Authority becomes aware that personal data breach has occurred, it shall inform the transferring Competent Authority within 48 hours and adopt reasonable and appropriate measures to find a remedy and minimize possible negative effects on Data Subjects, including directly communicating the personal data breach to them without unjustified delay, where this entails a considerable risk to their rights and liberties.

5. Procedures for the exercise of rights

Each Authority shall adopt appropriate measures so that, at the request of a Data Subject, it may:

(1) confirm whether it is processing personal data concerning the Data Subject and, if so, grant access to the data, as well as provide information about processing, including information on the purposes of the said processing, the categories of data considered, the origin and recipients of data, the expected retention period and the possibility to file complaints or appeals;

(2) identify all personal data of the requesting subject it has transferred to the other Authority pursuant to these Clauses;

(3) provide general information, also through its own site, about the guarantees that are applicable to transfers to the other Authority.

Each Authority shall fulfil, in a reasonable and timely way, a request made by a Data Subject concerning access to, correction and deletion of data, processing restriction or the exercise of the right not to be subject to automated decisions. Ordinary mail or e-mail addresses for sending the above requests shall be indicated in the general report provided to the Data Subjects referred to under clause 3 paragraph III of the Regulation on transparency. A Competent Authority may adopt appropriate measures such as charging a reasonable fee to pay the administrative costs of the request or refuse to fulfil it, if the said request proves to be manifestly groundless or exorbitant.

Each Competent Authority may employ automated procedures to more effectively achieve its own purposes, provided that it states the reasons and gives plausible explanations about the rationale used. In this case, the previous explicit consent of Data Subjects shall be obtained or they shall be recognized the right not to be subjected to automated decision making. In any case, Data Subjects shall be entitled to have erroneous or incomplete information regarding them corrected and to request that an automated decision be reviewed by means of human intervention.

The rights of Data Subjects may be limited to a necessary and proportionate extent in order to safeguard important public interest objectives recognized by the Parties in the spirit of reciprocity inherent in international cooperation. This field shall include the protection of the rights and freedoms of others, national security, defense, prevention, investigation, detection and prosecution of criminal offences or the enforcement of criminal penalties, as well as the performance of a control, inspection or regulatory function linked, even occasionally, to the enforcement and supervisory activities of the Authorities exercising the public powers vested in them. Said limitations, to be regulated by law, may remain in place only as long as the reason behind them persists.

6. Further communication and transfer of personal data

6.1 Further communication of personal data

A receiving Authority may proceed to further communication of personal data to another Authority of the same country only upon prior written authorization of the transferring Authority and on condition that the other Authority provides the same guarantees envisaged by these Clauses. In its request for authorization the receiving Authority shall provide information on the type of data it intends to communicate, on the other Authority, as well as on the legal basis, reasons and purpose of communication.

A receiving Authority may, by way of exception, proceed to further communication of personal data to another Authority of the same country without prior written authorization of the transferring Authority only if this is necessary for at least one of the following reasons:

protection of the vital interests of a Data Subject or another natural person;

ascertaining, exercising or defending a right in administrative or judicial proceedings;

conducting an investigation or criminal proceedings closely linked to the activities for which data was transferred.

In the aforementioned cases, the receiving Authority shall inform in advance the transferring Authority of the further data communication, providing elements on the requested data, the other Authority and the relevant legal basis. If prior information conflicts with a confidentiality obligation, as in the case of ongoing investigations, the receiving Authority shall inform as soon as possible the transferring Authority of the further communication made. In such cases, the transferring Authority shall keep a record of said notifications and communicate them to its own Supervisory Authority, at its request. The receiving Authority shall ensure that further communication, without prior authorization, of personal data received in compliance with these Clauses be limited, in particular by exerting all applicable exemptions and limitations.

6.2 Further transfer of personal data

A receiving Authority may proceed to the further transfer of personal data to another Authority of a third country or of an international organization only upon prior written authorization of the transferring Authority that shall assess its request taking account of all relevant factors, including seriousness of the offence, purpose of data transfer and level of personal data protection in that third country or international organization. In its written request for authorization, the receiving Authority shall provide sufficient information on the type of data it intends to communicate to the aforesaid other Authority, as well as on the legal basis, reasons and purpose of further transfer.

7. Duration of data retention

The Authorities shall retain personal data for the time envisaged by the applicable legal requirements that shall not exceed the necessary and proportionate period in a democratic society, with regard to the purposes for which data is processed.

8. Administrative and judicial protection

If a Data Subject considers that the Authority has not complied with the guarantees provided for in these Clauses or that the personal data relating to him or her have been unlawfully processed, he or she has the right to lodge a complaint with a supervisory Authority and to obtain judicial protection from a judicial authority, in compliance with the legal provisions applicable in the jurisdiction where the violation was allegedly perpetrated. Moreover, the Data Subject has the right to receive compensation for any damage suffered.

In case of any dispute or claim put forward by a Data Subject against the transferring Authority, the receiving Authority or both Authorities, relating to the processing of his or her personal data, the Authorities shall promptly and amicably inform each other about the said dispute or claim.

Where a Data Subject makes a claim and the transferring Authority considers that the receiving Authority has not acted in compliance with the guarantees provided for in these Clauses, the transferring Authority shall suspend the transfer of personal data to the receiving Authority until it considers that the latter has solved the problem in a satisfactory manner. The transferring Authority shall inform both its own supervisory Authority and the Data Subject about further developments of the issue.

IV. Supervision

1. External supervision to ensure proper implementation of these Clauses shall be guaranteed by the supervisory Authority.

2. Each Competent Authority shall periodically review its policies and procedures to ensure implementation and effectiveness of these Clauses. Where a reasonable request is made by a Competent Authority, the requested Competent Authority shall review its own policies and procedures relating to the processing of personal data with a view to verifying and confirming that the guarantees under these Clauses have been effectively implemented. The review results shall be communicated to the Competent Authority that requested the review.

3. Where a receiving Competent Authority is not able, for any reason, to effectively implement the guarantees pursuant to these Clauses, it shall inform the transferring Competent Authority without delay, in which case the latter shall temporarily suspend the transfer of personal data to the receiving Competent Authority until the latter confirms to be able again to act in compliance with the said guarantees. The receiving Competent Authority and the transferring Competent Authority shall keep their respective supervisory Authorities informed in this regard.

4. Where a transferring Competent Authority considers that the receiving Authority has not acted in compliance with the guarantees provided for in these Clauses, the transferring Competent Authority shall suspend the transfer of personal data to the receiving Competent Authority until it considers that the latter has solved the problem satisfactorily. The transferring Competent Authority shall keep its own supervisory Authority informed in this respect.

V. Review of the Clauses

1. The Parties shall consult each other to review terms and conditions of these Clauses in case of substantial changes in the applicable legal requirements, under Article 15, Paragraph 3 of this Agreement.

2. All personal data that have been already transferred pursuant to these Clauses shall continue to be processed in compliance with the guarantees provided for therein.