The issues of privacy and the protection of identity are of particular relevance in the context of return, when contact is made with authorities, service agencies and family members in the victim’s country of origin. The OSCE commitments stress the need to safeguard the privacy of victims, including by raising awareness among the media of the risks involved in public disclosure of the victim’s identity or of any other confidential information that could undermine the victim’s safety or access to justice in criminal proceedings.87 The Council of Europe Trafficking Convention requires State Parties to protect the private life and identity of victims.88 To this end, the Convention requires that personal data regarding victims be stored and used in conformity with the “Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data”.89 The identity of or details that may identify a child victim of trafficking must not be made publicly known except in exceptional circumstances, where such details are used to facilitate the tracing of family members or to otherwise secure the well-being and protection of the child.90 Personal data protection standards of the EU provide that data may only be stored, transmitted or disseminated if certain conditions are met.91 In particular, appropriate technological and organizational methods must be applied to prevent the unauthorized disclosure of or access to data, particularly when data are transmitted over a network.92 Of particular relevance in the context of return is the requirement that personal data only be transferred to a third country if an adequate level of data protection is provided by the third country.93 Practitioners also recommend that the returning country’s law enforcement agencies not reveal to the authorities in the receiving country that the person being returned has been trafficked, without first obtaining that person’s explicit consent. This is 87  OSCE Action Plan, para. 7.4. 88  Council of Europe Trafficking Convention, art. 11(1). 89  Council of Europe Trafficking Convention, art. 11(1). Article 7 of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data requires that appropriate security measures be taken for the protection of personal data stored in automated data files against, amongst other actions, unauthorized access, alteration or dissemination(see Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (adopted on 28 January 1981; entered into force on 1 October 1985), the Council of Europe, CETS No. 108. According to the convention, states must also establish appropriate sanctions and remedies for violations of such measures (article 10). 90  Council of Europe Trafficking Convention, art. 11. 91  EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, 1995 OJ L 281. These conditions include, inter alia, that the subject has given consent, that the processing is necessary for compliance with legal obligations or to protect the vital interests of the data subject. 92  Ibid., art. 17. 93  Ibid., art. 25. The EU Group of Experts recommends that, before personal information is exchanged with the country of origin, authorities should ensure that an appropriate level of data protection is guaranteed, and that all persons with access to personal data are bound by a duty of confidentiality. They also recommend that co-operation agreements between law enforcement authorities and those who are working with victims include provisions guaranteeing that the identity and other personal data of the trafficked person will not be forwarded without the consent of the trafficked person or the proper authority to do so (see Report of the EU Group of Experts, rec. 40, pp. 23-24). 46 Part 2: Explanatory Report to the Principles