Artikel 9

The communication of personal data shall only take place if such communication is necessary for the implementation of this Agreement. The processing and treatment of personal data by the competent authorities of the Parties in a particular case shall be subject to the domestic laws of Mongolia and, where the processing and treatment is done by a competent authority of a State of the Benelux, to the provisions of Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and of the relevant national legislation adopted pursuant to this Regulation. Additionally, the following principles shall apply:
1. Personal data shall be processed fairly, lawfully and in a transparent manner in relation to the data subject;
2. Personal data shall be collected for the specified, explicit and legitimate purpose of implementing this Agreement and not further processed by the communicating authority nor by the receiving authority in a way incompatible with that purpose;
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose for which they are collected and/or further processed; in particular, personal data communicated may concern only the following: 1. the particulars of the person to be readmitted (surnames, given names, any previous names, other names used/by which known or aliases, sex, civil status, date and place of birth, current and previous nationality);
2. passport, identity card or driving licence (number, period of validity, date of issue, issuing authority, place of issue)
3. stop-overs and itineraries;
4. other information needed to identify the person to be readmitted or to examine the readmission requirements pursuant to this Agreement including photographs and fingerprints;
5. special circumstances relating to the transferee, including information on the assistance which the transferee may require and on other protection or security measures which may be necessary for the transfer;
1. the particulars of the person to be readmitted (surnames, given names, any previous names, other names used/by which known or aliases, sex, civil status, date and place of birth, current and previous nationality);
2. passport, identity card or driving licence (number, period of validity, date of issue, issuing authority, place of issue)
3. stop-overs and itineraries;
4. other information needed to identify the person to be readmitted or to examine the readmission requirements pursuant to this Agreement including photographs and fingerprints;
5. special circumstances relating to the transferee, including information on the assistance which the transferee may require and on other protection or security measures which may be necessary for the transfer;
4. Personal data shall be accurate and, where necessary, kept up-to-date;
5. Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the data were collected or for which they are further processed;
6. Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures;
7. Both the communicating and the receiving authority shall take every reasonable step to ensure as appropriate the rectification, erasure or blocking of personal data where the processing does not comply with the provisions of this Article, in particular because those data are not adequate, relevant, accurate or they are excessive in relation to the purpose of processing. This includes the notification of any rectification, erasure or blocking to the other Party;
8. Upon request, the receiving authority shall inform the communicating authority of the use of the communicated data and of the results obtained therefrom;
9. Personal data may only be communicated to the competent authorities. Further communication to other bodies requires the prior consent of the communicating authority;
10. The communicating and the receiving authorities are obliged to make a written record of the communication and receipt of personal data.