What Needs to be Done Prior to Shipping

Transfer of personal data to Member States of the European Union and the European Economic Area - Free flow of personal data - Article 62

Whenever personal data is supplied to a data controller, data processor or data recipient established, having its seat or registered in a Member State of the European Union or the European Economic Area or otherwise subject to the legal order thereof, the provisions of this Act on the transfer of personal data to third countries shall not apply.

Transfer of personal data to third countries - General provision - Article 63

(1) The supply of personal data that is processed or will be processed only after being supplied to a third country, shall be permitted in accordance with the provisions of this Act and provided that the National Supervisory Body issues a decision that the country to which the data is transferred ensures an adequate level of protection of personal data.

(2) The decision from the previous paragraph shall not be required if the third country is on the list of those countries from Article 66 of this Act that have been found to fully ensure an adequate level of protection of personal data.

(3) The decision from the first paragraph of this Article shall not be required if the third country is on the list of those countries from Article 66 of this Act that have been found in part to ensure an adequate level of protection of personal data, if the personal data is transferred for those purposes for which an adequate level of protection has been found.

Procedure for determining an adequate level of protection of personal data -

Article 64

(1) The National Supervisory Body shall initiate a procedure to determine an adequate level of protection of personal data in a third country on the basis of a conclusion of inspection supervision or at the suggestion of a natural person or legal person who can show a legal interest in the issuing of a decision.

(2) At the request of the National Supervisory Body, the Ministry responsible for foreign affairs shall obtain from the competent body of a third country the necessary information as to whether such country ensures an adequate level of protection of personal data.

(3) The National Supervisory Body may obtain additional information on the adequate level of protection of personal data in a third country directly from other supervisory bodies and the competent body of the European Union.

(4) The National Supervisory Body shall issue a decision within two months of receipt of full information from the second and third paragraphs of this Article. It may also issue a decision only for a certain type of personal data or for their processing for an individual purpose.

(5) The National Supervisory Body shall be obliged no later than within 15 days of the issuing of a decision that a third country fails to ensure an adequate level of protection of personal data to inform the competent body of the European Union in writing.

List - Article 66

(1) The National Supervisory Body shall maintain a list of third countries for which it finds that have fully or partly ensured an adequate level of protection of personal data, or have not ensured such protection. If it has been determined that a third country only partly ensures an adequate level of protection of personal data, the list shall also set out in which part an adequate level has been ensured.

(2) The Chief National Supervisor shall publish the list from the previous paragraph in the Official Gazette of the Republic of Slovenia.

Please see the Information Commissioner website for further details on the statute