What Needs to be Done Prior to Shipping

Transfer of Personal Data to States that are not Members of the European Community

Article 68

The data controller may not transfer personal data to a State that is not a Member of the European Community if this State does not provide a sufficient level of the protection of individuals’ privacy, liberties and fundamental rights with regard to the actual or possible processing of their personal data.

The sufficient nature of the protection provided by the State shall be assessed taking account in particular of the provisions in force in this State, the security measures that this State applies, the specific characteristics of the processing, such as its purposes and duration, as well as the nature, origin and destination of the processed data.

Article 69

However, the data controller may transfer the personal data to a State not satisfying the conditions provided for in Article 68 if the data subject has expressly consented to their transfer or if the transfer is necessary subject to one of the following conditions for:

(1) the protection of the data subject’s life;

(2) the protection of the public interest;

(3) the meeting of obligations ensuring the establishment, exercise or defence of legal claims;

(4) the consultation, in accordance with legal conditions, of a public register that, according to legislative and regulatory provisions, is intended for public information and is open for public consultation or by any person demonstrating a legitimate interest;

(5) the performance of a contract between the data controller and the data subject, or of pre-contractual measures taken in response to the data subject’s request;

(6) the conclusion or performance of a contract, either concluded or to be concluded in the interest of the data subject between the data controller and a third party;.

Please refer to the French Data Protection Authority website for further details on the statute