Artikel 13

The communication of personal data shall only take place if such communication is necessary for the implementation of this Agreement. The processing, the treatment and the use of personal data by the competent authorities of the Kyrgyz Republic in a particular case shall be subject to the national laws of the Kyrgyz Republic and, where the data is treated and used by a competent authority of a Benelux State, to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC of 24 October 1995 (General Data Protection Regulation) and of the national legislation of the respective Benelux States adopted pursuant to this Regulation. Additionally, the following principles shall apply:
1. Personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
2. Personal data shall be collected for the specified, explicit and legitimate purpose of implementing this Agreement and not further processed by the communicating authority nor by the receiving authority in a way incompatible with that purpose; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes (“purpose limitation”);
3. Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”) and not excessive in relation to the purpose for which they are collected and/or further processed; in particular, personal data communicated may concern only the following: 1. the particulars of the person to be readmitted (surname, given name, any previous names, nicknames or pseudonyms, date and place of birth, sex, current and previous nationality);
2. identity card or passport (serial number, period of validity, date of issue, issuing authority and place of issue);
3. stop-overs and itineraries;
4. other information needed to identify the person to be readmitted or to examine the readmission requirements pursuant to this Agreement;
1. the particulars of the person to be readmitted (surname, given name, any previous names, nicknames or pseudonyms, date and place of birth, sex, current and previous nationality);
2. identity card or passport (serial number, period of validity, date of issue, issuing authority and place of issue);
3. stop-overs and itineraries;
4. other information needed to identify the person to be readmitted or to examine the readmission requirements pursuant to this Agreement;
4. Personal data shall be accurate and, where necessary, kept up-to-date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);
5. Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes and subject to implementation of the appropriate technical and organizational measures in order to safeguard the rights and freedoms of the data subject (“storage limitation”);
6. Both the communicating and the receiving authority shall take every adequate step to ensure as appropriate the rectification, erasure or blocking of personal data where the processing does not comply with the provisions of this Article, in particular because those data are not adequate, relevant, accurate or they are excessive in relation to the purpose of processing. This includes the notification of any rectification, erasure or blocking to the other Party;
7. Upon request, the receiving authority shall inform the communicating authority of the use of the communicated data and of the results obtained therefrom;
8. Personal data may only be communicated to the competent authorities. Further communication to other bodies requires the prior consent of the communicating authority;
9. The communicating and the receiving authorities are obliged to make a written record of the communication and receipt of personal data;
10. Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (“integrity and confidentiality”).