What Needs to be Done Prior to Shipping

Part 7 - Transfer of personal data to third countries

27

(1) Transfer to a third country of data may take place only if the third country in question ensures an adequate level of protection, cf. however subsection (3).

(2) The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation, in particular the nature of the data, the purpose and duration of the processing operation, the country of origin and country of final destination, the rules of law in force in the third country in question and the professional rules and security measures which are complied with in that country;

(3) In addition to the cases mentioned in subsection (1), transfer of data to a third country may take place on condition that:

1. the data subject has given his explicit consent; or
2. the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken in response to the data subject’s request; or
3. the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or
4. the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or
5. the transfer is necessary in order to protect the vital interests of the data subject; or
6. the transfer is made from a register which according to law or regulations is open to consultation either by the public in general or by any person who can demonstrate legitimate interests, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case; or
7. the transfer is necessary for the prevention, investigation and prosecution of criminal offences and the execution of sentences or the protection of persons charged, witnesses or any other persons in criminal proceedings; or
8. the transfer is necessary to safeguard public security, the defence of the Realm, and national security.

(4) Outside the scope of the transfers referred to in subsection (3), the Data Protection Agency may authorise a transfer of personal data to a third country which does not comply with the provisions laid down in subsection (1), where the controller adduces adequate safeguards with respect to the protection of the rights of the data subject. More detailed conditions may be laid down for the transfer. The Data Protection Agency shall inform the European Commission and the other Member States of the authorizations that it grants pursuant to this provision.

(5) The rules laid down in this Act shall otherwise apply to transfers of personal data to third countries in accordance with subsections (1), (3) and (4).

Please refer to the Danish Data Protection Agency website for further details of the statute