Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 84
Country Source Text or translation (excerpts; notes are given in italics)
Uruguay Data Protection Act,
no 18.331 (2008)
Article 23. Data transferred internationally. It is prohibited to transfer
personal data of any type to countries or international bodies that do not
provide adequate levels of protection in accordance with the standards of
international or regional law in this regard. The prohibition shall not
apply in cases of:
1) international judicial cooperation, in conformity with the respective
international instrument, such as a treaty or a convention, according to
the circumstances of the case;
2) exchange of medical data, when the situation demands that the
affected person be treated for reasons of public health or hygiene;
3) banking or stock-market information transfers, in relation to the
respective transactions and in conformity with the legislation applicable
to such transfers;
4) agreements within the framework of international treaties to which the
Oriental Republic of Uruguay is party;
5) international cooperation between intelligence agencies for combating
organised crime, terrorism and drug trafficking.
The international transfer of data shall also be permissible in the
following circumstances:
A) the interested party has given his/her unequivocal consent to the
proposed transfer;
B) the transfer is necessary for the performance of a contract between the
interested party and the data controller or for the execution of
precontractual measures taken at the request of the interested party;
C) the transfer is necessary for the execution or performance of a contract
entered into, or to be entered into, in the interests of the interested party,
between the data controller and a third party;
D) the transfer is necessary or legally required for the safeguarding of an
important public interest, or for the recognition, exercise or defence of a
right in a judicial proceeding;
E) the transfer is necessary for the safeguarding of the vital interest of the
interested party.
F) The transfer is made from a register which, by virtue of legal or
regulatory provisions, is designed to facilitate the provision of
information to the public and is open to consultation by the general
public or by any person who can demonstrate a legitimate interest,
provided, in each individual case, the conditions established by law for
its consultation are satisfied.
Without prejudice to the provisions of the first paragraph of this article,
the Unidad Reguladora y de Control de Protección de Datos Personales
[Data Protection Authority] may authorise a transfer or a series of
transfers of personal data to a third-party country that does not guarantee
an adequate level of protection when the data controller offers sufficient
guarantees regarding the protection of privacy, fundamental human rights
and liberties, and regarding the exercise of the respective rights. These
guarantees may derive from appropriate contractual clauses.