What Needs to be Done Prior to Shipping

Article 28 Transfer of Personal Data to Data Recipients in Third Countries

1. Transfer of personal data to recipients in foreign countries shall be subject to an authorization from the State Data Protection Inspectorate, except in the cases referred to in paragraph 4 of this Article.

2. The State Data Protection Inspectorate shall grant an authorization for transfer of personal data to foreign countries, provided that there is an adequate level of personal data protection in these countries. The level of legal protection of personal data shall be assessed in the light of all circumstances surrounding a data transfer operation, by giving particular consideration to the laws and other legal acts in force in the country of destination providing legal protection of personal data, the nature of the data, the proposed processing operations, purposes of processing, its duration and safeguards which shall be observed in the third country in question.

3. The State Data Protection Inspectorate may grant an authorization to transfer personal data to a third country which cannot guarantee an adequate level of legal protection of personal data on condition that the data controller has established adequate safeguards for the protection of an individual’s right to privacy as well for protection and exercise of the other rights of the data subject. Such safeguards must be stipulated in the contract on the transfer of personal data to a third country.

4. Without an authorization of the State Data Protection Inspectorate personal data shall be transferred to a third country or an international law enforcement organization only if:

1) the data subject has given his consent to the transfer of the data;

2) the transfer of personal data is necessary for the conclusion or performance of a contract between the data controller and a third party concluded in the interests of the data subject;

3) the transfer of personal data is necessary for the performance of a contract between the data controller and the data subject or the implementation of pre-contractual measures taken in response to the data subject’s request;

4) the transfer of personal data is necessary or legally required in the public interest or for the purpose of legal proceedings;

5) the transfer is necessary in order to protect the vital interests of the data subject;

6) the transfer is necessary for the prevention or investigation of criminal offences;

7) the data is transferred from a public data file following the procedure prescribed by laws and other legal acts.

Please refer to the State Data Protection Inspectorate website for further details on the statute