Principles and general rules
Article 63
The Parties agree that the legal and regulatory regimes and administrative capacity to be established shall, at a minimum, include the following content principles and enforcement mechanisms: (a) Content principles (i) The purpose limitation principle — data should be processed for a specific purpose and subsequently used or further communicated only insofar as this is not incompatible with the purpose of the transfer. The only exemptions to these rights should be those provided for in legislation and necessary in a democratic society for the protection of important public interests. (ii) The data quality and proportionality principle — data should be accurate and, where necessary, kept up to date. The data should be adequate, relevant and not excessive in relation to the purposes for which they are transferred or further processed. (iii) The transparency principle — individuals should be provided with information as to the purpose of the processing and the identity of the data controller in the third country, and other information insofar as this is necessary to ensure fairness. The only exemptions to these rights should be those provided for in legislation and necessary in a democratic society for the protection of important public interests. (iv) The security principle — the data controller should take technical and organisational security measures that are appropriate to the risks presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process data except on instructions from the controller. (v) The rights of access, rectification and opposition — the data subject should have the right to obtain a copy of all data relating to him/her that are processed, and the right to rectify those data where they are shown to be inaccurate. In certain situations he/she should also be able to object to the processing of the data relating to him/her. The only exemptions to these rights should be those provided for in legislation and necessary in a democratic society for the protection of important public interests. (vi) Restrictions on onward transfers — as a matter of principle, further transfers of the personal data by the recipient of the original data transfer should be permitted only where the second recipient (i.e. the recipient of the onward transfer) is also subject to rules affording an adequate level of protection. (vii) Sensitive data — where special categories of data are involved, revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, data concerning health and sex, and data relating to offences, criminal convictions or security measures, additional safeguards should be in place. (b) Enforcement mechanisms Appropriate mechanisms should be in place to ensure that the following objectives are achieved: (i) to ensure a good level of compliance with the rules, including a high degree of awareness among data controllers of their obligations, and among data subjects of their rights and the means of exercising them; the existence of effective and dissuasive sanctions; and systems of verification by authorities, auditors or independent data protection officials; (ii) to provide support and help to individual data subjects in the exercise of their rights, which they must be able to enforce rapidly and effectively, and without prohibitive cost, including through an appropriate institutional mechanism allowing independent investigation of complaints; (iii) to provide appropriate redress to the injured party where rules are not complied with, allowing compensation to be paid and sanctions imposed where appropriate.