[F1CHAPTER IIIU.K.PROCESSING OF PERSONAL DATA AND SECURITY

Article 13U.K.Purpose limitation

IMI actors [F2of the United Kingdom] shall exchange and process personal data only for the purposes defined in the relevant provisions of [F3any legislation] listed in the Annex.

Data submitted to IMI by data subjects shall only be used for the purposes for which the data were submitted.

Textual Amendments

Article 14U.K.Retention of personal data

1.Personal data processed in IMI shall be blocked in IMI as soon as they are no longer necessary for the purpose for which they were collected, depending on the specificities of each type of administrative cooperation and, as a general rule, no later than six months after the formal closure of the administrative cooperation procedure.

However, if a longer period is provided for in [F4any legislation] listed in the Annex, personal data processed in IMI may be retained for a maximum of 18 months after the formal closure of an administrative cooperation procedure.

2.Where a repository of information for future reference by IMI actors is required pursuant to [F5any legislation] listed in the Annex, the personal data included in such a repository may be processed for as long as they are needed for this purpose either with the data subject’s consent or where this is provided for in that [F6legislation].

3.Personal data blocked pursuant to this Article shall, with the exception of their storage, only be processed for purposes of proof of an information exchange by means of IMI with the data subject’s consent, unless processing is requested for overriding reasons in the public interest.

4.The blocked data shall be automatically deleted in IMI three years after the formal closure of the administrative cooperation procedure.

5.At the express request of a competent authority in a specific case and with the data subject’s consent, personal data may be deleted before the expiry of the applicable retention period.

F76.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F87.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

Article 15U.K.Retention of personal data of IMI users

1.By way of derogation from Article 14, paragraphs 2 and 3 of this Article shall apply to the retention of personal data of IMI users [F9of the United Kingdom]. Those personal data shall include the full name and all electronic and other means of contact necessary for the purposes of this Regulation.

2.Personal data relating to IMI users shall be stored in IMI as long as they continue to be users of IMI and may be processed for purposes compatible with the objectives of this Regulation.

3.When a natural person ceases to be an IMI user, the personal data relating to that person shall be blocked by technical means for a period of three years. Those data shall, with the exception of their storage, only be processed for purposes of proof of an information exchange by means of IMI and shall be deleted at the end of the three-year period.

Textual Amendments

F10Article 16U.K.Processing of special categories of data

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

Article 17U.K.Security

F111.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F112.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

F113.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4.IMI actors [F12of the United Kingdom] shall take all procedural and organisational measures necessary to ensure the security of personal data processed by them in IMI in accordance with [F13Articles 5(1)(f), 28 and 32 of the UK GDPR.]]

Textual Amendments

Textual Amendments