What Needs to be Done Prior to Shipping

Transfer of personal data to outside the European Union

Section 22 — General prerequisites

(1) Personal data may be transferred to outside the European Union or the European Economic Area only if the country in question guarantees an adequate level of data protection.

(2) The adequacy of the level of data protection shall be evaluated in the light of the nature of the data, the purpose and duration of the intended processing, the country of origin and the country of final destination, as well as the general and sectoral legal provisions, codes of conduct and security measures applied in that country.

Section 23 — Grounds for derogation

However, section 22 does not prevent the transfer of data if:

(1) the data subject has unambiguously consented to the transfer;

(2) the data subject has given an assignment for the transfer, or this is necessary in order to perform a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract;

(3) the transfer is necessary in order to make or perform an agreement between the controller and a third party and in the interest of the data subject;

(4) the transfer is necessary in order to protect the vital interests of the data subject;

(5) the transfer is necessary or called for by law for securing an important public interest or for purposes of drafting or filing a lawsuit or for responding to or deciding such a lawsuit;

(6) the transfer is made from a file, the disclosure of data from which, either generally or for special reasons, has been specifically provided in an Act; or

(7) the controller, by means of contractual terms or otherwise, gives adequate guarantees of the protection of the privacy and the rights of individuals.

Please refer to The Office of the Data Protection Ombudsman website for further details on the statute