Corrigendum to Commission Decision 2004/411/EC of 28 April 2004 on the adequate protection of personal data in the Isle of Man (OJ L 151, 30.4.2004)
Date: 2004-06-10
Institutions: European Commission
Subjects: Isle of Man, confidentiality, cross-frontier data flow, disclosure of information, fundamental rights, personal data, protection of privacy

10.6.2004

EN

Official Journal of the European Union

L 208/47

Corrigendum to Commission Decision 2004/411/EC of 28 April 2004 on the adequate protection of personal
data in the Isle of Man

(Official Journal of the European Union L 151 of 30 April 2004)

Decision 2004/411/EC should read as follows:

COMMISSION DECISION

of 28 April 2004

on the adequate protection of personal data in the Isle of Man

(notified under document number C(2004) 1556)

(Text with EEA relevance)

(2004/411/EC)

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

having regard to the Treaty establishing the European Com-
munity,

having regard to Directive 95/46/EC of the European Parlia-
ment and of the Council of 24 October 1995 on the protection
of individuals with regard to the processing of personal data
and on the free movement of such data (1), and in particular
Article 25(6) thereof,

After consulting the Working Party on the Protection of Indivi-
duals with regard to the processing of Personal Data (2),

whereas:

(1)

(2)

(3)

to Directive 95/46/EC Member States are
Pursuant
required to provide that the transfer of personal data to
a third country may take place only if the third country
in question ensures an adequate level of protection and
if the Member States'
laws implementing other provi-
sions of the Directive are complied with prior to the
transfer.

The Commission may find that a third country ensures
an adequate level of protection. In that case, personal
data may be transferred from the Member States without
additional guarantees being necessary.

Pursuant to Directive 95/46/EC the level of data protec-
tion should be assessed in the light of all the circum-
stances surrounding a data transfer operation or a set of
data transfer operations, and giving particular considera-
tion to a number of elements relevant for the transfer
and listed in Article 25(2) thereof.

(4)

Given the different approaches to data protection in
the adequacy assessment should be
third countries,

(1) OJ L 281, 23.11.1995, p. 31; Directive as amended by Regulation

(EC) No 1882/2003 (OJ L 284, 31.10.2003, p.1).

(2) Opinion No 6/2003 on the level of protection of personal data in
the Isle of Man, adopted by the Working Party on 21 November
2003, available at
http://europa.eu.int/comm/internal_market/privacy/workingroup/
wp2003/wpdocs03_en.htm

carried out, and any decision based on Article 25(6) of
Directive 95/46/EC should be made and enforced in a
way that does not arbitrarily or unjustifiably discriminate
against or between third countries where like conditions
prevail, nor constitute a disguised barrier to trade, regard
being had to the Community's present
international
commitments.

(5)

(6)

(7)

(8)

The Isle of Man is one of the dependencies of the British
Crown (being neither part of the United Kingdom nor a
colony) that enjoys full independence, except for interna-
tional relations and defense which are the responsibility
of the United Kingdom Government. The Isle of Man
should therefore be considered as a third country within
the meaning of the Directive.

At the island's request, with effect from May 1993, the
United Kingdom's ratification of the Council of Europe
Convention on the Protection of Individuals with regard
to Automatic Processing of Personal Data (Convention
No 108) was extended to the Isle of Man.

As regards the Isle of Man, the legal standards on the
protection of personal data based on the standards set
out in Directive 95/46/EC have been provided for in the
Data Protection Act 2002 (the Act), which entered into
force on 1 April 2003. This Act repeals and replaces the
Data Protection Act 1986 (the 1986 Act).

Other laws which impact or are likely to impact upon
data protection include the Human Rights Act 2001,
which was passed by Parliament on 16 January 2001
and is not yet fully in force and the Access to Health
Records and Reports Act 1993.

L 208/48

EN

Official Journal of the European Union

10.6.2004

(9)

(10)

(11)

The legal standards applicable in the Isle of Man cover
all the basic principles necessary for an adequate level of
protection for natural persons. The application of these
standards is guaranteed by judicial remedy and by inde-
pendent supervision carried out by the authorities, such
as the Data Protection Commissioner
invested with
powers of investigation and intervention.

The Isle of Man should therefore be regarded as
providing an adequate level of protection for personal
data as referred to in Directive 95/46/EC.

In the interest of transparency and in order to safeguard
the ability of the competent authorities in the Member
States to ensure the protection of individuals as regards
the processing of their personal data, it is necessary to
in which the
specify the exceptional circumstances
suspension of specific data flows may be justified,
notwithstanding the finding of adequate protection.

(12)

The measures provided for in this Decision are in
accordance with the opinion of the Committee estab-
lished under Article 31(1) of Directive 95/46/EC,

HAS ADOPTED THIS DECISION:

Article 1

For the purposes of Article 25(2) of Directive 95/46/EC, the
Isle of Man is considered as providing an adequate level of
protection for personal data transferred from the Community.

Article 2

This Decision concerns the adequacy of protection provided in
the Isle of Man with a view to meeting the requirements of
Article 25(1) of Directive 95/46/EC and does not affect other
conditions or restrictions implementing other provisions of
that Directive that pertain to the processing of personal data
within the Member States.

Article 3

1. Without prejudice to their powers to take action to
ensure compliance with national provisions adopted pursuant
to provisions other than Article 25 of Directive 95/46/EC, the
competent authorities in Member States may exercise their
existing powers to suspend data flows to a recipient in the Isle
of Man in order to protect individuals with regard to the
processing of their personal data in the following cases:

(a) where a competent Isle of Man authority has determined
that the recipient is in breach of the applicable standards of
protection; or

(b) where there is a substantial likelihood that the standards of
reasonable
protection are being infringed,
grounds for believing that
Isle of Man
authority is not taking or will not take adequate and timely

the competent

there

are

steps to settle the case at issue, the continuing transfer
would create an imminent risk of grave harm to data
subjects and the competent authorities in the Member State
have made reasonable efforts in the circumstances to
provide the party responsible for processing established in
the Isle of Man with notice and an opportunity to respond.

2.
The suspension shall cease as soon as the standards of
protection are assured and the competent authority of the
Member States concerned is notified thereof.

Article 4

1. Member States shall
delay when measures are adopted on the basis of Article 3.

inform the Commission without

The Member States and the Commission shall

inform
2.
each other of cases where the action of bodies responsible for
ensuring compliance with the standards of protection in the
Isle of Man fails to secure such compliance.

If the information collected under Article 3 and under
3.
paragraphs 1 and 2 of this Article provides evidence that any
body responsible for ensuring compliance with the standards of
protection in the Isle of Man is not effectively fulfilling its role,
the Commission shall
Isle of Man
authority and, if necessary, present draft measures in accord-
ance with the procedure referred to in Article 31(2) of Directive
95/46/EC with a view to repealing or suspending this Decision
or limiting its scope.

inform the competent

Article 5

The Commission shall monitor the functioning of this Decision
and report any pertinent findings to the Committee established
under Article 31 of Directive 95/46/EC, including any evidence
that could affect the finding in Article 1 of this Decision that
protection in the Isle of Man is adequate within the meaning of
Article 25 of Directive 95/46/EC and any evidence that this
Decision is being implemented in a discriminatory way.

Article 6

Member States shall take all the measures necessary to comply
with the Decision within four months of the date of its notifica-
tion.

This Decision is addressed to the Member States.

Article 7

Done at Brussels, 28 April 2004.

For the Commission

Frederik BOLKESTEIN

Member of the Commission