What Needs to be Done Prior to Shipping

Article 29: Conditions for the Transfer Abroad of Personal Data

(1) The transfer to another state of data that is subject to processing or is destined be processed after being transferred may take place only if the Romanian law is not infringed and the state of destination ensures an adequate level of protection.

(2) The protection level will be assessed by the supervisory authority taking into account all the circumstances in which the transfer is to be performed, especially the nature of the data to be transferred, the purpose and the period of time proposed for the processing, the state of origin and the state of final destination, as well as the legislation of the latter state. In case the supervisory authority notices that the protection level offered by the state of destination is unsatisfactory, it may ban the data transfer.

(3) Data transferred to another state shall always be subject to preliminary notification to the supervisory authority.

(4) The supervisory authority may authorize the data transfer to another state which does not offer at least the same protection level as the one offered by the Romanian legislation, provided that the data controller offers enough guarantees regarding the protection of fundamental individual rights. The guarantee must be established through contracts signed by the data controllers and the natural or legal person(s) who have offered the transfer.

(5) The provisions of paragraphs (2), (3) and (4) do not apply in case the data transfer is based on a special law or on an international agreement ratified by Romania, notably if the transfer is done to the purpose of prevention, investigation or repressing a criminal offense.

(6) The provisions of the present article do not apply when the data is processed exclusively for journalistic, literary or artistic purposes, if the data were made public expressly by the data subject or are related to the data subject’s public quality or to the public character of the facts he/she is involved in.

Article 30: Situations in which the Transfer is Always Allowed

The data transfer is always allowed in the following situations:

a) when the data subject has explicitly given his/her consent for the transfer; if the data transfer is linked to any of the data provided in Articles 7, 8 and 10 the consent must be written;

b) when it is required in order to carry out a contract signed by the data subject and the data controller, or to apply some pre-contractual measures taken upon the request of the data subject;

c) when it is required in order to sign or carry out a contract concluded or about to be concluded between the controller and a third party, in the data subject’s interest;

d) when it is necessary for the accomplishment of a major public interest, such as national defense, public order or national safety, carrying out in good order a criminal trial or ascertaining, exercising or defending a right in court, on the condition that the data is processed solely in relation with this purpose, and only for as long as it is required;

e) when it is required in order to protect the data subject’s life, physical integrity or health;

f) when it is a consequence of a previous request for access to official documents that are open to the public or of a request for information that can be obtained from registers or any other documents of public access.

Please see the National Authority for the Supervision of Personal Data Processing for more information

www.dataprotection.ro/index.php?lang=en_GB