Regulation of Transborder Data Flows under ... - Tilburg University

More documents

Recommendations

Info

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 84 Country Source Text or translation (excerpts; notes are given in italics) Uruguay Data Protection Act, no 18.331 (2008) Article 23. Data transferred internationally. It is prohibited to transfer personal data of any type to countries or international bodies that do not provide adequate levels of protection in accordance with the standards of international or regional law in this regard. The prohibition shall not apply in cases of: 1) international judicial cooperation, in conformity with the respective international instrument, such as a treaty or a convention, according to the circumstances of the case; 2) exchange of medical data, when the situation demands that the affected person be treated for reasons of public health or hygiene; 3) banking or stock-market information transfers, in relation to the respective transactions and in conformity with the legislation applicable to such transfers; 4) agreements within the framework of international treaties to which the Oriental Republic of Uruguay is party; 5) international cooperation between intelligence agencies for combating organised crime, terrorism and drug trafficking. The international transfer of data shall also be permissible in the following circumstances: A) the interested party has given his/her unequivocal consent to the proposed transfer; B) the transfer is necessary for the performance of a contract between the interested party and the data controller or for the execution of precontractual measures taken at the request of the interested party; C) the transfer is necessary for the execution or performance of a contract entered into, or to be entered into, in the interests of the interested party, between the data controller and a third party; D) the transfer is necessary or legally required for the safeguarding of an important public interest, or for the recognition, exercise or defence of a right in a judicial proceeding; E) the transfer is necessary for the safeguarding of the vital interest of the interested party. F) The transfer is made from a register which, by virtue of legal or regulatory provisions, is designed to facilitate the provision of information to the public and is open to consultation by the general public or by any person who can demonstrate a legitimate interest, provided, in each individual case, the conditions established by law for its consultation are satisfied. Without prejudice to the provisions of the first paragraph of this article, the Unidad Reguladora y de Control de Protección de Datos Personales [Data Protection Authority] may authorise a transfer or a series of transfers of personal data to a third-party country that does not guarantee an adequate level of protection when the data controller offers sufficient guarantees regarding the protection of privacy, fundamental human rights and liberties, and regarding the exercise of the respective rights. These guarantees may derive from appropriate contractual clauses.
Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 85 C. Other important instruments Name Source Text or translation (excerpts; notes are given in italics) European Union (voluntary measures) Binding Corporate Rules: Article 29 Working Party, ‘Working Document setting up a framework for Binding Corporate Rules’ (WP 154, 24 June 2008), at 7 Standard Contractual Clauses: Commission Decision (EC) 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive (EC) 95/46/EC of the European Parliament and of the Council, [2010] OJ L39/5 Commission Decision (EC) 2004/915 of 27 December 2004 amending Decision (EC) 2001/497 as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries, [2004] OJ L385/74 Safe Harbor Privacy Principles issued by the US Department of Commerce on July 21, 2000, and recognized as ‘adequate’ under European Commission Binding corporate rules must contain ‘an explanation of the measures in place to restrict transfers and onward transfers outside of the group’, and a commitment that all transfers to external controllers and processors located outside of the EU must respect EU rules on transborder data flows. Clause 11: The non-EU data importer must not transfer the data to a subprocessor unless EU-based legal standards are complied with. Clause II(h): The non-EU data importer must process the personal data transferred in accordance with EU-based legal standards. Clause II(i): The non-EU data importer must not transfer the data to a third party located outside the EEA unless EU-based legal standards are complied with. ONWARD TRANSFER: To disclose information to a third party, organizations must apply the Notice and Choice Principles. Where an organization wishes to transfer information to a third party that is acting as an agent, as described in the endnote, it may do so if it first either ascertains that the third party subscribes to the Principles or is subject to the Directive or another adequacy finding or enters into a written agreement with such third party requiring that the third party provide at
Page 1 and 2:
TILT (TILBURG INSTITUTE FOR LAW, TE
Page 3 and 4:
Kuner/Regulation of Transborder Dat
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34: Kuner/Regulation of Transborder Dat
Page 83: Kuner/Regulation of Transborder Dat
show all

Regulation of Transborder Data Flows under ... - Tilburg University

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?