Artikel 16

1. Any information or documents received under this Agreement shall be eligible for use in administrative and judicial proceedings falling within the scope of application of this Agreement.
2. On request, the customs administration that provided the information may, notwithstanding paragraph 1 of this Article, authorise its use by other authorities or for other purposes, subject to any terms and conditions it may specify. Such use shall be in accordance with the legal and administrative provisions of the Contracting Party which seeks to use the information. The use of information for other purposes includes its use in criminal investigations, prosecutions or proceedings.
3. Any information received under this Agreement shall be subject to the level of confidentiality and protection that the same kind of information is subject to under the national legal and administrative provisions of the Contracting Party where it is received.
4. Any personal data exchanged under this Agreement shall, at least, be subject to the level of protection afforded to personal data in the national legal or administrative provisions of the Contracting Party whose customs administration provided these personal data.
5. Contracting Parties shall provide each other with all legislation relevant to this Article. Personal data exchange will not begin before this legislation has been received. In case the legislation is amended both Parties will inform each other about the amendments immediately.
6. The exchange of personal data under this Agreement shall take place in accordance with the legal and administrative provisions of either Contracting Party and shall be subject to the following:
a) The Customs administrations of the Contracting Parties shall ensure that personal data are collected in a lawful and transparent manner and used only for the specified purpose for which they were supplied, in accordance with the conditions set by the requested administration;
b) Personal data shall be provided solely to the competent Customs authorities of the Contracting Parties. Further transmission to other authorities may take place only with prior permission from the requested administration;
c) Personal data supplied under this Agreement shall be kept only for the time necessary to achieve the purpose for which it was supplied;
d) If personal data supplied is found to be inaccurate or should not have been exchanged, this shall be notified immediately. The Customs administration that has received such data shall erase or rectify it without delay;
e) The Customs administrations shall record the supply or receipt of personal data exchanged under this Agreement;
f) The Customs administrations shall take the necessary security measures to ensure the security of the personal data, including protection against accidental or unlawful destruction, loss, or alteration, and protection against unauthorised disclosure or access;
g) Each Contracting Party shall ensure that any individual who believes the Contracting Party has failed to comply with this Article, or that their personal data has been breached, may seek judicial redress in accordance with its domestic appeal and dispute resolution processes under applicable data protection laws and regulations;
h) Each Customs administration shall ensure it has appropriate measures in place to respond, without undue delay, to any enquiries and requests it receives from a natural person relating to the processing of their personal data pursuant to this Agreement, subject to the Contracting Party’s legal obligation not to disclose confidential information pursuant to professional secrecy, other legal obligations or safeguard public interest;
i) Each Contracting Party shall provide that a designated authority reviews any complaint raised by a natural person with a view to determining whether the processing of that natural person’s personal data by the Contracting Party constitutes an infringement of that Contracting Party’s laws and regulations or any of the requirements set out in this Agreement.