What Needs to be Done Prior to Shipping

Transfer of Personal Data to a third country

Prohibition of transfer of personal data to a third country

Section 33

It is prohibited to transfer to a third country personal data that is undergoing processing unless the third country has an adequate level of protection for personal data. The provision also applies to transfer of personal data for processing in a third country.

The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding the transfer. Particular consideration shall be given to the nature of the data, the purpose of the processing, the duration of the processing, the country of origin, the country of final destination and the rules that exist for the processing in the third country.

Exemptions from the prohibition of transfer of personal data to a third country

Section 34

Notwithstanding the prohibition in Section 33, it is permitted to transfer personal data to a third country if the registered person has given his/her consent to the transfer or if the transfer is necessary for

a) the performance of a contract between the registered person and the controller of personal data or the implementation of pre-contractual measures taken in response to the request of the registered,

b) the conclusion or performance of a contract between the controller of personal data and a third party which is in the interest of the registered person,

c) the establishment, exercise or defence of legal claims, or

d) the protection of vital interests of the registered person.

It is also permitted to transfer personal data for use only in a state that has acceded to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.

Please see the Swedish Data Protection Board website for further details on the statute