AGREEMENT BETWEEN THE GOVERNMENT OF THE REPUBLIC OF LATVIA AND CABINET OF MINISTERS OF UKRAINE ON MUTUAL RECOGNITION AND EXCHANGE OF NATIONAL DRIVING LICENSES

1The transmission of special categories of personal data, in

2particular those related to racial or ethnic origin, political,

3religious or philosophical beliefs, membership in political

4parties and trade unions, as well as data relating to health,

5sexual life, biometric or genetic data within the framework of

6this Agreement shall be prohibited. Personal data related to

7criminal convictions shall not be transferred as well. These

8categories of data may be transmitted and processed only in

9exceptional cases, expressly provided by the legislation

10applicable in the territory of the State of the requested

11Contracting Party.

1The Contracting Parties shall ensure an appropriate level

2of protection of personal data transmitted and received under

3this Agreement by taking specific and appropriate organizational

4and technical security measures, as well as classifying personal

5data into general and special categories, strict restriction of

6access to data, establishing the procedure for storing data in

7accordance with their category and with the application of

8proportional security and confidentiality measures, as well as

9the use of methods of pseudonymization or data encryption.

10The Contracting Parties shall guarantee that the protection of

11special categories of data shall include the provision of

12enhanced organizational and technical security measures.

1The Contracting Parties shall take all necessary measures

2to ensure the reliability, accuracy and relevance of the

3transmitted personal data, as well as their proportionality to

4the purposes. In the event when after the transmission of data

5any Contracting Party becomes aware of their unreliability,

6disproportionateness or inaccuracy, it shall immediately notify

7the other Contracting Party in this regard in order to make the

8necessary changes.

1The transmitted personal data shall be destroyed or

2corrected in the following cases:

3a) in case of personal data is found to be unreliable,

4disproportionate or inaccurate to the purposes of processing.

5b) in case of the requested Contracting Party reported that

6the transmission of personal data was previously recognized as

7inconsistent with the requirements of the legislation applicable

8in the territory of its State.

9c) in case of personal data is no longer needed to achieve the

10purposes defined in this Agreement.

11d) in case of expiration of the processing period, if it was

12directly established by the requested Contracting Party.

13e) in case of termination of this Agreement.

1The Contracting Parties shall guarantee the maintenance of

2a register of the transmission and destruction of personal data.

3Entries in the register shall contain information on the amount

4of personal data transmitted, the date, time and purpose of their

5transmission, as well as the competent authority/person

6transmitting, receiving or destroying personal data.

1The competent authorities of the States of the Contracting

2Parties shall ensure that data subjects have the right to obtain

3from the competent authority an information on whether or not

4personal data concerning him or her are being processed, and,

5when that is the case, access to the personal data and the

6information about the categories of personal data concerned; the

7recipients or categories of recipients to whom the personal data

8have been or will be disclosed; the identity and the contact

9details of the competent authorities of the States of the

10Contracting Parties; the contact details of the data protection

11officer; the purposes of the personal data processing; the right

12to lodge a complaint with a supervisory authority and the contact

13details thereof where possible, the envisaged period for which

14the personal data will be stored, or, if not possible, the

15criteria used to determine that period; the existence of the

16right to request from the competent authority rectification or

17erasure of personal data or restriction of processing of personal

18data concerning the data subject; where the personal data are not

19collected from the data subject, any available information as to

20their source.

1Upon the request of a data subject concerned, whose data

2have been transmitted pursuant to the provisions of this

3Agreement to the competent authority of the State of the other

4Contracting Party, such data subject within one month after

5receipt of the request by the competent authority, shall be

6provided with the information on action taken on the request. The

7competent authority of each Contracting Party may apply an

8administrative fee or refuse to act on the request if the data

9subject's requests are manifestly unfounded or

10disproportionate, in particular due to their repetitive

11nature.

1A data subject, whose data have been transmitted pursuant

2to the provisions of this Agreement, shall have the possibility

3to require to have incomplete personal data concerning him/her

4completed or to have inaccurate personal data concerning him/her

5rectified, erased as well as to require to restrict processing of

6personal data in case the transmission thereof infringes the

7provisions of this Agreement. The competent authorities of the

8States of the Contracting Parties shall inform the competent

9authority, from which the inaccurate personal data have been

10received, about the rectification or erasure of inaccurate or

11supplementation of incomplete personal data as well as the

12restriction of processing of personal data due to the request of

13a data subject. The right of a data subject concerned to receive

14such information shall be governed by the legislation applicable

15in the territory of the State of the Contracting Party, in the

16territory of which such request is submitted.

1The Contracting Parties shall ensure that the national

2personal data protection supervisory authority, acting in

3accordance with the appropriate legislation applicable in the

4territory of the States of the Contracting Parties, shall

5supervise the compliance with the requirements for the protection

6of personal data provided for in this Agreement. In case of

7violation of the right to the protection of personal data, the

8affected natural persons shall have the right to lodge a

9complaint to national data protection supervisory authority and

10the right to access to justice in accordance with the legislation

11applicable in the territory of the State of the respective

12Contracting Party.

1If the competent authority of one Contracting Party

2becomes aware of a personal data breach, it shall inform the

3competent authority of the other Contracting Party as soon as

4possible and, in coordination with the mentioned competent

5authority, use reasonable and appropriate means to remedy the

6personal data breach to minimise the potential adverse effects.

7The competent authority of one of the Contracting Parties shall

8also notify the data subject without undue delay of a breach of

9personal data security, when the breach of personal data security

10may result in a significant risk to the rights and freedoms of a

11data subject.

12Article 10