7. RESPECTING PRIVACY AND DATA PROTECTION PRINCIPLES
Depending on Participants or the enforcement activity in question, it may be necessary to exchange personal data. However, in accordance with recognised privacy and data protection principles, the exchange of such personal data should be limited to what is necessary for effective privacy and data protection enforcement. All Participants to this Arrangement who either disclose or receive personal data will use their best efforts to respect the data protection safeguards of each other. However, it is recognised that these best efforts alone will not always be sufficient to enable the exchange of personal data.
In that case, if the Participant disclosing the personal data requires specific data protection safeguards, they should either:
- request the other Participants to provide assurance that they will comply with the requirements outlined in Schedule One; or
- make other arrangements between those who disclose and receive personal data to ensure that each Participant’s privacy and data protection requirements are fully observed.
Participants should notify the Committee if they are committing to the requirements set out in Schedule One or notify the Committee of other arrangements as referenced above. In principle, this notification should be done when submitting a notice of intent to participate in accordance with section 13, or, in any case before receiving personal data from another Participant under this Arrangement. A list of Participants, including their initial and updated notifications regarding Schedule One and/or other arrangements as described above, will be made available to all Participants.