What Needs to be Done Prior to Shipping

Chapter VI - Transfer of personal data to countries outside the European Community

Article 21

1. Personal data that is undergoing processing or that is intended for processing after transfer may be transferred to a country outside the European Community only if, without prejudice to compliance with the provisions laid down by or by virtue of this law, the third country in question ensures an adequate level of protection.

The adequacy of the level of protection shall be assessed in the light of all the circumstances surrounding a data transfer operation or a category of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the intended processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the country in question and the professional rules and security measures that are complied with in that country.

2. The King shall lay down after advice of the Commission for the Protection of Privacy and in accordance with Article 25 of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, for which categories of processing operations of personal data and under which circumstances the transfer of personal data to countries outside the European Community is not authorised.

Article 22

1. As a derogation from Article 21 a transfer or category of transfers of personal data to a country outside the European Community that does not ensure an adequate level of protection may take place in one of the following cases:

1° the data subject has given his consent unambiguously to the intended transfer;

2° the transfer is necessary for the performance of a contract between the data subject and the controller or for the implementation of pre-contractual measures taken in response to the request of the data subject;

3° the transfer is necessary for the conclusion or performance of a contract concluded or to be concluded in the interest of the data subject between the controller and a third party;

4° the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims;

5° the transfer is necessary in order to protect the vital interests of the data subject;

6° the transfer is made from a public register that according to legal or regulatory provisions is intended to provide information to the public and that is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case.

2. Without prejudice to the provisions of the previous section the King may after advice of the Commission for the Protection of Privacy authorize a transfer or a category of transfers to a country outside the European Community that does not ensure an adequate level of protection, if the controller adduces adequate safeguards with regard to the protection of the privacy and fundamental rights and freedoms of individuals as well as with regard to the exercise of the corresponding rights; such safeguards may in particular result from appropriate contractual clauses.

Please refer to the Commission’s website for further details of the statute