Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 81
Country Source Text or translation (excerpts; notes are given in italics)
Senegal Law No. 2008-12 of
January 25, 2008, on
the Protection of
Personal Data
Serbia Law on Personal Data
Protection (October
2008)
Article 49
The data controller shall not transfer any personal data abroad unless the
foreign country ensures a sufficient level of protection for privacy rights,
rights and freedoms of data subjects in relation to the processing of
personal data. Before any transfer of personal data to a foreign country,
the data controller shall inform the DPA.
Before any process of personal data coming from abroad, the DPA shall
ensure that the data controller provides a sufficient level of protection for
privacy rights, rights and freedoms of data subjects in relation to the
processing of personal data.
The level of protection provided by the data controller shall be assessed
in light of security measures which are applied in compliance with the
Act, and criteria of the process such as its purposes, duration, nature,
origin and destination of data.
Article 50
The data controller may transfer personal data to a foreign country that
does not fulfill the requirements mentioned in the article above if the
transfer is limited, not substantial and if the data subject gave its express
consent to the transfer or if the transfer is justified by one of the
following conditions:
1) protection of data subject’s life;
2) protection of public interest;
3) compliance with mandatory rules regarding judicial process; or
4) contractual obligations between the data controller and the data
subject.
Article 51
The DPA may authorize, upon request, the transfer of personal data or a
group of transfers to a foreign country that does not provide an adequate
level of protection if the data controller offers guarantees regarding
privacy rights, rights and freedoms of data subjects and their ability to
exercise those rights.
Article 53
Data can be transferred from the Republic of Serbia to a state party to the
Council of Europe Convention for the Protection of Individuals with
regard to Automatic Processing of Personal Data.
Data may be transferred from the Republic of Serbia to a state that is not
a party to the Convention referred to in paragraph 1 of this Article or an
international organization if such state or international organization has a
regulation or a data transfer agreement in force which provides a level of
data protection equivalent to that envisaged by the Convention.
In cases of transborder transfer of data referred to in paragraph 2 of this
Article, the Commissioner shall determine whether the requirements are
met and safeguards put in place for the transfer of data from the Republic
of Serbia and shall authorize such transfer.