Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 75
Country Source Text or translation (excerpts; notes are given in italics)
Mauritius Data Protection Act
2004, Act No. 13 of
2004
Article 31 - Transfer of personal data
(1) Subject to subsection (2), no data controller shall, except with the
written authorization of the Commissioner, transfer personal data to a
third country.
(2) The Eighth data protection principle specified in the First Schedule
shall not apply where -
(a) the data subject has given his consent to the transfer;
(b) the transfer is necessary -
(i) for the performance of a contract between the data subject and the data
controller, or for the taking of steps at the request of the data subject with
a view to his entering into a contract with the data controller;
(ii) for the conclusion of a contract between the data controller and a
person, other than the data subject, which is entered at the request of the
data subject, or is in the interest of the data subject, or for the
performance of such a contract;
(iii) in the public interest, to safeguard public security or national
security.
(c) the transfer is made on such terms as may be approved by the
Commissioner as ensuring the adequate safeguards for the protection of
the rights of the data subjects.
(3) For the purpose of subsection (2) (c), the adequacy of the level of
protection of a country shall be assessed in the light of all the
circumstances surrounding the data transfer, having regards in particular
to -
(a) the nature of the data;
(b) the purpose and duration of the proposed processing;
(c) the country of origin and country of final destination;
(d) the rules of law, both general and sectoral, in force in the country in
question; and
(e) any relevant codes of conduct or other rules and security measures
which are complied with in that country.