Regulation (EC) No 810/2009 of the European Parliament and of the CouncilDangos y teitl llawn

ANNEX X U.K. LIST OF MINIMUM REQUIREMENTS TO BE INCLUDED IN THE LEGAL INSTRUMENT IN THE CASE OF COOPERATION WITH EXTERNAL SERVICE PROVIDERS

A.

In relation to the performance of its activities, the external service provider shall, with regard to data protection:

(a)

prevent at all times any unauthorised reading, copying, modification or deletion of data, in particular during their transmission to the diplomatic mission or consular post of the Member State(s) competent for processing an application;

(b)

in accordance with the instructions given by the Member State(s) concerned, transmit the data,

• electronically, in encrypted form, or

• physically, in a secured way;

(c)

transmit the data as soon as possible:

• in the case of physically transferred data, at least once a week,

• in the case of electronically transferred encrypted data, at the latest at the end of the day of their collection;

(d)

delete the data immediately after their transmission and ensure that the only data that might be retained shall be the name and contact details of the applicant for the purposes of the appointment arrangements, as well as the passport number, until the return of the passport to the applicant, where applicable;

(e)

ensure all the technical and organisational security measures required to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the cooperation involves the transmission of files and data to the diplomatic mission or consular post of the Member State(s) concerned and all other unlawful forms of processing personal data;

(f)

process the data only for the purposes of processing the personal data of applicants on behalf of the Member State(s) concerned;

(g)

apply data protection standards at least equivalent to those set out in Directive 95/46/EC;

(h)

provide applicants with the information required pursuant to Article 37 of the VIS Regulation.

B.

In relation to the performance of its activities, the external service provider shall, with regard to the conduct of staff:

(a)

ensure that its staff are appropriately trained;

(b)

ensure that its staff in the performance of their duties:

• receive applicants courteously,

• respect the human dignity and integrity of applicants,

• do not discriminate against persons on grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation, and

• respect the rules of confidentiality which shall also apply once members of staff have left their job or after suspension or termination of the legal instrument;

(c)

provide identification of the staff working for the external service provider at all times;

(d)

prove that its staff do not have criminal records and have the requisite expertise.

C.

In relation to the verification of the performance of its activities, the external service provider shall:

(a)

provide for access by staff entitled by the Member State(s) concerned to its premises at all times without prior notice, in particular for inspection purposes;

(b)

ensure the possibility of remote access to its appointment system for inspection purposes;

(c)

ensure the use of relevant monitoring methods (e.g. test applicants; webcam);

(d)

ensure access to proof of data protection compliance, including reporting obligations, external audits and regular spot checks;

(e)

report to the Member State(s) concerned without delay any security breaches or any complaints from applicants on data misuse or unauthorised access, and coordinate with the Member State(s) concerned in order to find a solution and give explanatory responses promptly to the complaining applicants.

D.

In relation to general requirements, the external service provider shall:

(a)

act under the instructions of the Member State(s) competent for processing the application;

(b)

adopt appropriate anti-corruption measures (e.g. provisions on staff remuneration; cooperation in the selection of staff members employed on the task; two-man-rule; rotation principle);

(c)

respect fully the provisions of the legal instrument, which shall contain a suspension or termination clause, in particular in the event of breach of the rules established, as well as a revision clause with a view to ensuring that the legal instrument reflects best practice.