Personal data processed in IMI shall be blocked in IMI as soon as they are no longer necessary for the purpose for which they were collected, depending on the specificities of each type of administrative cooperation and, as a general rule, no later than six months after the formal closure of the administrative cooperation procedure.

However, if a longer period is provided for in F4any legislation listed in the Annex, personal data processed in IMI may be retained for a maximum of 18 months after the formal closure of an administrative cooperation procedure.

Where a repository of information for future reference by IMI actors is required pursuant to F5any legislation listed in the Annex, the personal data included in such a repository may be processed for as long as they are needed for this purpose either with the data subject’s consent or where this is provided for in that F6legislation.

Personal data blocked pursuant to this Article shall, with the exception of their storage, only be processed for purposes of proof of an information exchange by means of IMI with the data subject’s consent, unless processing is requested for overriding reasons in the public interest.

The blocked data shall be automatically deleted in IMI three years after the formal closure of the administrative cooperation procedure.

At the express request of a competent authority in a specific case and with the data subject’s consent, personal data may be deleted before the expiry of the applicable retention period.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

By way of derogation from Article 14, paragraphs 2 and 3 of this Article shall apply to the retention of personal data of IMI users F9of the United Kingdom. Those personal data shall include the full name and all electronic and other means of contact necessary for the purposes of this Regulation.

Personal data relating to IMI users shall be stored in IMI as long as they continue to be users of IMI and may be processed for purposes compatible with the objectives of this Regulation.

When a natural person ceases to be an IMI user, the personal data relating to that person shall be blocked by technical means for a period of three years. Those data shall, with the exception of their storage, only be processed for purposes of proof of an information exchange by means of IMI and shall be deleted at the end of the three-year period.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

IMI actors F12of the United Kingdom shall take all procedural and organisational measures necessary to ensure the security of personal data processed by them in IMI in accordance with F13Articles 5(1)(f), 28 and 32 of the UK GDPR.