What Needs to be Done Prior to Shipping

International movement of data

Article 33 General rule

1. There may be no temporary or permanent transfers of personal data which has been

processed or which was collected for the purpose of such processing to countries which do not provide a level of protection comparable to that provided by this Law, except where, in addition to complying with this Law, prior authorization is obtained from the Director of the Data Protection Agency, who may grant it only if adequate guarantees are obtained.

2. The adequacy of the level of protection afforded by the country of destination shall be assessed by the Data Protection Agency in the light of all the circumstances surrounding the data transfer or category of data transfer. Particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question, the content of the reports by the Commission of the European Union, and the professional rules and security measures in force in those countries.

Article 34 Derogations

The provisions of the preceding paragraph shall not apply where:

a) The international transfer of personal data is the result of applying treaties or agreements to which Spain is a party.

b) The transfer serves the purposes of offering or requesting international judicial aid.

c) The transfer is necessary for medical prevention or diagnosis, the provision of health aid or medical treatment, or the management of health services.

d) Where the transfer of data is related to money transfers in accordance with the relevant legislation.

e) The data subject has given his unambiguous consent to the proposed transfer.

f) The transfer is necessary for the performance of a contract between the data subject and the controller or the adoption of pre-contractual measures taken at the data subject's request.

g) The transfer is necessary for the conclusion or performance of a contract concluded, or to be concluded, in the interest of the data subject, between the controller and a third party.

h) The transfer is necessary or legally required to safeguard a public interest. A transfer requested by a tax or customs authority for the performance of its task shall be considered as meeting this condition.

i) The transfer is necessary for the recognition, exercise or defence of a right in legal proceedings.

j) The transfer takes place at the request of a person with a legitimate interest, from a public register, and the request complies with the purpose of the register.

k) The transfer takes place to a Member State of the European Union or to a country which the Commission of the European Communities, in the exercise of its powers, has declared to ensure an adequate level of protection.

Please see the Spanish Data Protection Authority website for further details on the statute