|
What Needs to be
Done Prior to Shipping
Chapter IV
-Transfer of data to third countries
Article 18
Principles
(1) Transfers to a
third country of data that are the subject of processing, or that
will be the subject of processing after their transfer, may take
place only where the country in question provides an adequate level
of protection and complies with the provisions of this Law and its
implementing regulations.
(2) The adequacy
of the level of protection afforded by a third country must be
assessed by the controller in the light of all the circumstances
surrounding a data transfer operation or set of data transfer
operations; particularly the nature of the data, the purpose and
duration of the proposed processing operation or operations, the
country of origin and country of final destination, the rules of
law, both general and
sectoral,
in force in the third country in question and the professional rules
and security measures which are complied with in that country.
(3) In the event
of doubt, the controller will immediately inform the Commission
Nationale which will consider whether the third country offers an
adequate level of protection. In accordance with Article 20 the
Commission
Nationale will
notify the European Commission of cases where it considers that the
third country does not offer an adequate level of protection.
(4) If the
European Commission or Commission Nationale finds that a third
country does not have an adequate level of protection, transfer of
data to that country will be prohibited.
(5) Any party who
transfers data to a third country in violation of the provisions of
paragraphs (1), (2) and (4) above will be liable to a prison
sentence of between eight days and one year and a fine of between
251 and 125,000 euros or only one of these penalties. The court
hearing the case may order the discontinuance of any transfer that
is contrary to the provisions of paragraphs (1), (2) and (4) of this
Article, subject to a financial penalty the maximum amount of which
will be set by the said court.
Article 19
Derogations
(1) The transfer
of data or a set of data to a third country that does not offer an
adequate level of protection within the meaning of Article 18,
paragraph (2), may, however, take place, provided:
(a) the data
subject has given his consent to the proposed transfer; or
(b) the transfer
is necessary for the performance of a contract to which the data
subject and the controller are parties or the implementation of
pre-contractual measures taken at the data subject's request; or
(c) the transfer
is necessary for the conclusion or performance of a contract
concluded in the interest of the data subject between the controller
and a third party; or
Please see the
Commission Nationale pour la Protection des donnees website for
further details on the statute
|
