2004/411/EC:Commission Decision of 28 April 2004 on the adequate protection of personal data in the Isle of Man
Date: 2004-04-28
Institutions: European Commission
Subjects: Isle of Man, confidentiality, cross-frontier data flow, disclosure of information, fundamental rights, personal data, protection of privacy

L 151/48

EN 

Official Journal of the European Union 

30.4.2004 

COMMISSION DECISION 

of 28 April 2004 

on the adequate protection of personal data in the Isle of Man 

(notified under document number C(2004) 1556) 

(Text with EEA relevance) 

(2004/411/EC) 

THE COMMISSION OF THE EUROPEAN COMMUNITIES, 

having regard to the Treaty establishing the European Community, 

having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 
1995 on the protection of individuals with regard to the processing of personal data and on the 
free movement of such data1, and in particular Article 25(6) thereof, 

After consulting the Working Party on the Protection of Individuals with regard to the processing 
of Personal Data2, 

whereas: 

(1) 

(2) 

(3) 

1 
2 

Pursuant to Directive 95/46/EC Member States are required to provide that the transfer of 
personal  data  to  a  third  country  may  take  place  only  if  the  third  country  in  question 
ensures an adequate level of protection and if the Member States’ laws implementing other 
provisions of the Directive are complied with prior to the transfer. 

The Commission may find that a third country ensures an adequate level of protection. In 
that  case,  personal  data  may  be  transferred  from  the  Member  States  without  additional 
guarantees being necessary. 

Pursuant to Directive 95/46/EC the level of data protection should be assessed in the light 
of  all  the  circumstances  surrounding  a  data  transfer  operation  or  a  set  of  data  transfer 
operations, and giving particular consideration to a number of elements relevant for the 
transfer and listed in Article 25(2) thereof. 

OJ L 281, 23.11.1995, p. 31 
Opinion 6/2003 on the level of protection of personal data in the Isle of Man, adopted by the Working Party 
on 21 November 2003, available at 
http://europa.eu.int/comm/internal_market/privacy/workingroup/wp2003/wpdocs03_en.htm 

 
 
 
 
 
                                                 
 
30.4.2004 

EN 

Official Journal of the European Union 

L 151/49

(4) 

(5) 

(6) 

(7) 

(8) 

(9) 

(10) 

(11) 

Given  the  different  approaches  to  data  protection  in  third  countries,  the  adequacy 
assessment  should  be  carried  out,  and  any  decision  based  on  Article  25(6)  of  Directive 
95/46/EC should be made and enforced in a way that does not arbitrarily or unjustifiably 
discriminate  against  or  between  third  countries  where  like  conditions  prevail,  nor 
constitute  a  disguised  barrier  to  trade,  regard  being  had  to  the  Community's  present 
international commitments. 

The Isle of Man is one of the dependencies of the British Crown (being neither part of the 
United  Kingdom  nor  a  colony)  that  enjoys  full  independence,  except  for  international 
relations  and  defense  which  are  the  responsibility  of  the  United  Kingdom  Government. 
The Isle of Man should therefore be considered as a third country within the meaning of 
the Directive. 

At  the  island's  request,  with  effect  from  May  1993,  the  United  Kingdom's  ratification  of 
the  Council  of  Europe  Convention  on  the  Protection  of  Individuals  with  regard  to 
Automatic Processing of Personal Data (Convention No 108) was extended to the Isle of 
Man.  

As regards the Isle of Man, the legal standards on the protection of personal data based on 
the standards set out in Directive 95/46/EC have been provided for in the Data Protection 
Act  2002  ("the  Act"),  which  entered  into  force  on  1  April  2003.  This  Act  repeals  and 
replaces the Data Protection Act 1986 ("the 1986 Act"). 

Other laws which impact or are likely to impact upon data protection include the Human 
Rights  Act  2001,  which  was  passed  by  Parliament  on  16th  January  2001  and  is  not  yet 
fully in force and the Access to Health Records and Reports Act 1993. 

The legal standards applicable in the Isle of Man cover all the basic principles necessary for 
an adequate level of protection for natural persons. The application of these standards is 
guaranteed  by  judicial  remedy  and  by  independent  supervision  carried  out  by  the 
authorities,  such  as  the  Data  Protection  Commissioner  invested  with  powers  of 
investigation and intervention. 

The Isle of Man should therefore be regarded as providing an adequate level of protection 
for personal data as referred to in Directive 95/46/EC. 

In  the  interest  of  transparency  and  in  order  to  safeguard  the  ability  of  the  competent 
authorities  in  the  Member  States  to  ensure  the  protection  of  individuals  as  regards  the 
processing of their personal data, it is necessary to specify the exceptional circumstances 
in  which  the  suspension  of  specific  data  flows  may  be  justified,  notwithstanding  the 
finding of adequate protection. 

(12) 

The  measures  provided  for  in  this  Decision  are  in  accordance  with  the  opinion  of  the 
Committee established under Article 31(1) of Directive 95/46/EC, 

 
 
L 151/50

EN 

Official Journal of the European Union 

30.4.2004 

HAS ADOPTED THIS DECISION:  

Article 1 

For the purposes of Article 25(2) of Directive 95/46/EC, the Isle of Man is considered as providing 
an adequate level of protection for personal data transferred from the Community. 

Article 2 

This  Decision  concerns  the  adequacy  of  protection  provided  in  the  Isle  of  Man  with  a  view  to 
meeting  the  requirements  of  Article  25(1)  of  Directive  95/46/EC  and  does  not  affect  other 
conditions  or  restrictions  implementing  other  provisions  of  that  Directive  that  pertain  to  the 
processing of personal data within the Member States. 

1. 

2. 

1. 

2. 

Article 3 

Without  prejudice  to  their  powers  to  take  action  to  ensure  compliance  with  national 
provisions adopted pursuant to provisions other than Article 25 of Directive 95/46/EC, 
the  competent  authorities  in  Member  States  may  exercise  their  existing  powers  to 
suspend data flows to a recipient in the Isle of Man in order to protect individuals with 
regard to the processing of their personal data in the following cases: 

(a)  where  a  competent  Isle  of  Man  authority  has  determined  that  the  recipient  is  in 

breach of the applicable standards of protection; or 

(b)  where  there  is  a  substantial  likelihood  that  the  standards  of  protection  are  being 
infringed,  there  are  reasonable  grounds  for  believing  that  the  competent  Isle  of 
Man authority is not taking or will not take adequate and timely steps to settle the 
case at issue, the continuing transfer would create an imminent risk of grave harm 
to  data  subjects  and  the  competent  authorities  in  the  Member  State  have  made 
reasonable  efforts  in  the  circumstances  to  provide  the  party  responsible  for 
processing  established  in  the  Isle  of  Man  with  notice  and  an  opportunity  to 
respond. 

The  suspension  shall  cease  as  soon  as  the  standards  of  protection  are  assured  and  the 
competent authority of the Member States concerned is notified thereof. 

Article 4 

Member States shall inform the Commission without delay when measures are adopted 
on the basis of Article 3. 

The  Member  States  and  the  Commission  shall  inform  each  other  of  cases  where  the 
action of bodies responsible for ensuring compliance with the standards of protection in 
the Isle of Man fails to secure such compliance. 

 
 
 
30.4.2004 

EN 

Official Journal of the European Union 

L 151/51

3. 

If the information collected under Article 3 and under paragraphs 1 and 2 of this Article 
provides evidence that any body responsible for ensuring compliance with the standards 
of protection in the Isle of Man is not effectively fulfilling its role, the Commission shall 
inform the competent Isle of Man authority and, if necessary, present draft measures in 
accordance with the procedure referred to in Article 31(2) of Directive 95/46/EC with a 
view to repealing or suspending this Decision or limiting its scope. 

Article 5 

The Commission shall monitor the functioning of this Decision and report any pertinent findings 
to the Committee established under Article 31 of Directive 95/46/EC, including any evidence that 
could affect the finding in Article 1 of this Decision that protection in the Isle of Man is adequate 
within  the  meaning  of  Article  25  of  Directive  95/46/EC  and  any  evidence  that  this  Decision  is 
being implemented in a discriminatory way. 

Member  States  shall  take  all  the  measures  necessary  to  comply  with  the  Decision  within  four 
months of the date of its notification. 

Article 6 

Article 7 

This Decision is addressed to the Member States. 

Done at Brussels, 28 April 2004. 

For the Commission 

Frederik BOLKESTEIN 

Member of the Commission