20.9.2023
EN
Official Journal of the European Union
L 231/191
15.
Public Record and Publicly Available Information a.
An organization must apply the Principles of Security, Data Integrity and Purpose Limitation, and Recourse, Enforcement and Liability to personal data from publicly available sources.
These Principles shall apply also to personal data collected from public records (i.e., those records kept by government agencies or entities at any level that are open to consultation by the public in general). b.
It is not necessary to apply the Notice, Choice, or Accountability for Onward Transfer Principles to public record information, as long as it is not combined with non-public record information, and any conditions for consultation established by the relevant jurisdiction are respected.
Also, it is generally not necessary to apply the Notice, Choice, or Accountability for Onward Transfer Principles to publicly available information unless the European transferor indicates that such information is subject to restrictions that require application of those Principles by the organization for the uses it intends.
Organizations will have no liability for how such information is used by those obtaining such information from published materials. c.
Where an organization is found to have intentionally made personal information public in contravention of the Principles so that it or others may benefit from these exceptions, it will cease to qualify for the benefits of the EU-U.S. DPF. d.
It is not necessary to apply the Access Principle to public record information as long as it is not combined with other personal information (apart from small amounts used to index or organize the public record information); however, any conditions for consultation established by the relevant jurisdiction are to be respected.
In contrast, where public record information is combined with other non-public record information (other than as specifically noted above), an organization must provide access to all such information, assuming it is not subject to other permitted exceptions. e.
As with public record information, it is not necessary to provide access to information that is already publicly available to the public at large, as long as it is not combined with non-publicly available information.
Organizations that are in the business of selling publicly available information may charge the organization’s customary fee in responding to requests for access.
Alternatively, individuals may seek access to their information from the organization that originally compiled the data. 16.
Access Requests by Public Authorities a.
In order to provide transparency in respect of lawful requests by public authorities to access personal information, participating organizations may voluntarily issue periodic transparency reports on the number of requests for personal information they receive by public authorities for law enforcement or national security reasons, to the extent such disclosures are permissible under applicable law. b.
The information provided by the participating organizations in these reports together with information that has been released by the intelligence community, along with other information, can be used to inform the periodic joint review of the functioning of the EU-U.S. DPF in accordance with the Principles. c.
Absence of notice in accordance with point (a)(xii) of the Notice Principle shall not prevent or impair an organization’s ability to respond to any lawful request.