“personal data”, “processing of personal data” and “data controller”.
7 In other words,
there is a legal mandatory rule that obliges the parties to adopt an effective regime on
data protection.
Nevertheless, if the normative Chapter’s core is the article on objectives, the
Article on “principles” delineates its substantive content. It establishes not only
principles, but also the basis for rights and parameters of enforcement.
8 In analytic
terms:
implement the provisions of paragraph 1 as soon as possible and no later than seven years after the
entry into force of this Agreement.”
7 EU-CARIFORUM FTA, Chapter 6, Article 198: “Definitions. For the purposes of this Chapter:
(a) ‘personal data’ means any information relating to an identified or identifiable individual (data
subject); (b) ‘processing of personal data’ means any operation or set of operations which is
performed upon personal data, such as collection, recording, organisation, storage, alteration,
retrieval, consultation, use, disclosure, combination, blocking, erasure or destruction, as well as
transfers of personal data across national borders; (c) ‘Data Controller’ means the natural or legal
person, authority or any other body which determines the purposes and means of the processing of
personal data.”
8 EU-CARIFORUM, Article 199: “Principles and general rules. The Parties agree that the legal and
regulatory regimes and administrative capacity to be established shall, at a minimum, include the
following content principles and enforcement mechanisms: (a) Content principles (i) the purpose
limitation principle — data should be processed for a specific purpose and subsequently used or
further communicated only in so far as this is not incompatible with the purpose of the transfer. The
only exemptions to this rule would be those provided by legislation and necessary in a democratic
society for important public interests; (ii) the data quality and proportionality principle — data
should be accurate and, where necessary, kept up to date. The data should be adequate, relevant and
not excessive in relation to the purposes for which they are transferred or further processed; (iii) the
transparency principle — individuals should be provided with information as to the purpose of the
processing and the identity of the data controller in the third country, and other information in so far
as this is necessary to ensure fairness. The only exemptions permitted should be those provided by
legislation and necessary in a democratic society for important public interests; (iv) the security
principle — technical and organisational security measures should be taken by the data controller
that are appropriate to the risks presented by the processing. Any person acting under the authority
of the data controller, including a processor, must not process data except on instructions from the
controller; (v) the rights of access, rectification and opposition — the data subject should have a
right to obtain a copy of all data relating to him/her that are processed, and a right to rectification of
those data where they are shown to be inaccurate. In certain situations he/she should also be able to
object to the processing of the data relating to him/her. The only exemptions to these rights should
be those provided by legislation and necessary in a democratic society for important public
interests; (vi) restrictions on onward transfers — as a matter of principle, further transfers of the
personal data by the recipient of the original data transfer should be permitted only where the second
recipient (i.e. the recipient of the onward transfer) is also subject to rules affording an adequate level
of protection; (vii) sensitive data — where special categories of data are involved, revealing racial or
ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, data
concerning health or sex life, and data relating to offences, criminal convictions or security
measures, data may not be processed unless domestic law provides additional safeguards.
(b) Enforcement mechanisms Appropriate mechanisms shall be in place to ensure that the following
objectives are achieved: (i) to ensure a good level of compliance with the rules, including a high
degree of awareness among data controllers of their obligations, and among data subjects of their
rights and the means of exercising them; the existence of effective and dissuasive sanctions; and
systems of direct verification by authorities, auditors, or independent data protection officials; (ii) to
488
J. A. F. Costa
7 In other words,
there is a legal mandatory rule that obliges the parties to adopt an effective regime on
data protection.
Nevertheless, if the normative Chapter’s core is the article on objectives, the
Article on “principles” delineates its substantive content. It establishes not only
principles, but also the basis for rights and parameters of enforcement.
8 In analytic
terms:
implement the provisions of paragraph 1 as soon as possible and no later than seven years after the
entry into force of this Agreement.”
7 EU-CARIFORUM FTA, Chapter 6, Article 198: “Definitions. For the purposes of this Chapter:
(a) ‘personal data’ means any information relating to an identified or identifiable individual (data
subject); (b) ‘processing of personal data’ means any operation or set of operations which is
performed upon personal data, such as collection, recording, organisation, storage, alteration,
retrieval, consultation, use, disclosure, combination, blocking, erasure or destruction, as well as
transfers of personal data across national borders; (c) ‘Data Controller’ means the natural or legal
person, authority or any other body which determines the purposes and means of the processing of
personal data.”
8 EU-CARIFORUM, Article 199: “Principles and general rules. The Parties agree that the legal and
regulatory regimes and administrative capacity to be established shall, at a minimum, include the
following content principles and enforcement mechanisms: (a) Content principles (i) the purpose
limitation principle — data should be processed for a specific purpose and subsequently used or
further communicated only in so far as this is not incompatible with the purpose of the transfer. The
only exemptions to this rule would be those provided by legislation and necessary in a democratic
society for important public interests; (ii) the data quality and proportionality principle — data
should be accurate and, where necessary, kept up to date. The data should be adequate, relevant and
not excessive in relation to the purposes for which they are transferred or further processed; (iii) the
transparency principle — individuals should be provided with information as to the purpose of the
processing and the identity of the data controller in the third country, and other information in so far
as this is necessary to ensure fairness. The only exemptions permitted should be those provided by
legislation and necessary in a democratic society for important public interests; (iv) the security
principle — technical and organisational security measures should be taken by the data controller
that are appropriate to the risks presented by the processing. Any person acting under the authority
of the data controller, including a processor, must not process data except on instructions from the
controller; (v) the rights of access, rectification and opposition — the data subject should have a
right to obtain a copy of all data relating to him/her that are processed, and a right to rectification of
those data where they are shown to be inaccurate. In certain situations he/she should also be able to
object to the processing of the data relating to him/her. The only exemptions to these rights should
be those provided by legislation and necessary in a democratic society for important public
interests; (vi) restrictions on onward transfers — as a matter of principle, further transfers of the
personal data by the recipient of the original data transfer should be permitted only where the second
recipient (i.e. the recipient of the onward transfer) is also subject to rules affording an adequate level
of protection; (vii) sensitive data — where special categories of data are involved, revealing racial or
ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, data
concerning health or sex life, and data relating to offences, criminal convictions or security
measures, data may not be processed unless domestic law provides additional safeguards.
(b) Enforcement mechanisms Appropriate mechanisms shall be in place to ensure that the following
objectives are achieved: (i) to ensure a good level of compliance with the rules, including a high
degree of awareness among data controllers of their obligations, and among data subjects of their
rights and the means of exercising them; the existence of effective and dissuasive sanctions; and
systems of direct verification by authorities, auditors, or independent data protection officials; (ii) to
488
J. A. F. Costa