#52026XG02996EU notice on personal data used for human rights sanctions listings
AI-generated summary for informational purposes only. Not legal advice. See the original source for the authoritative text.
This notice explains how the Council of the EU processes personal data for people placed on the EU sanctions list for serious human rights violations and abuses. The data is used to identify listed individuals, record the reasons for their listing, and maintain measures such as asset freezes and travel restrictions. It mainly affects individuals subject to these sanctions, as well as institutions that handle sanctions compliance. The notice identifies the Council department responsible for the data, the data protection contact, the sources of the information, and the legal basis for processing it.
AI-generated summary. May contain errors. Refer to official sources for legal decisions.
Key Changes
- Explains the Council’s processing of personal data for EU human rights sanctions listings
- Identifies the responsible Council department and data protection contact points
- Clarifies that data may come from Member States and the European External Action Service
Obligations
What this law requires
The Council must process personal data only for establishing and updating the list of persons subject to restrictive measures under Decision (CFSP) 2020/1999 and Regulation (EU) 2020/1998, as amended or implemented by the 2026 acts.
The Council must retain personal data processed in the context of EU autonomous restrictive measures for 5 years after the data subject is removed from the asset-freeze list or the measure expires, unless legal action is pending before the Court of Justice, in which case retention must continue until final judgment.
The Council must keep personal data contained in Council-registered documents for archiving purposes in the public interest under Article 4(1)(e) of Regulation (EU) 2018/1725.
When transferring personal data to a third country or international organisation without an adequacy decision or appropriate safeguards, the Council must rely only on the grounds that the transfer is necessary for important reasons of public interest or for the establishment, exercise, or defence of legal claims.
The Council must not use automated decision-making when processing the personal data of listed data subjects.