What Needs to be Done Prior to Shipping

Art. 36a.

(1) Provision of personal data in a European Union Member State or in another European Economic Area Member State shall be made freely, by observing the requirements of this Act.

(2) Provision of personal data in a Third State shall be allowed only if such State is able to ensure an adequate level of personal data protection in its territory.

(3) The assessment concerning the adequacy of the level of personal data protection in a Third State shall be made by the Commission for Personal Data Protection, taking into consideration all circumstances related to the action or the aggregate of actions concerning the provision of data, inclusive the nature of the data, the objective and duration of their processing, their legal regulation and the security measures secured in such Third State.

(4) The assessment under para. 3 shall not be made, if the European Commission has pronounced decision concerning the level of personal data protection in the Third State to which such data are provided.

(5) The requirement under para. 2 shall not apply, if the provision of personal data is made under a Treaty - ratified, promulgated and enforced for Republic of Bulgaria.

(6) Beyond the cases under para. 2 and 4, the administrator may provide personal data in a Third State, if:

1. the person to whom the personal data refers, has given explicit consent for it;

2. such provision is necessary for the fulfillment of a contract between the physical person and administrator or is made upon request by the person;

3. such provision is necessary for the fulfillment of a contract concluded in the interest of the physical person between the administrator and another subject;

4. such provision is necessary or is required by law due to significant public interest or for establishing, exercising or protecting of rights in a judicial procedure;

5. such provision is necessary, in order to protect the life and health of the person, to whom the personal data refers;

6. publicly accessible data is provided.

(7) Provision of personal data in Third States shall be allowed in all cases, where it is made solely for the purposes of journalism, literary or artistic works, insofar such processing will not violate the right to privacy of the person to whom the personal data refers.

Transfer of data to non EU countries

Art. 36b

(1) Beyond the cases under Art 36а, the provision of personal data in a Third State shall be made with the permission of the Commission for Personal Data Protection provided that the administrator providing the data and the administrator obtaining them submit sufficient guarantees for their protection.

(2) The Commission shall notify the European Commission and the competent authorities of the other Member States of the permissions provided under para. 1.

Please refer to the Commission for Personal Data Protection website for further details of the statute