Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 86
Name Source Text or translation (excerpts; notes are given in italics)
European
Union and
United States
Decision (EC)
2000/520 of 26 July
2000 [2000], OJ
L215/7
Agreement between
the European Union
and the United States
of America on the
processing and
transfer of Passenger
Name Record (PNR)
data by air carriers to
the United States
Department of
Homeland Security
(DHS) (2007 PNR
Agreement), [2007]
OJ L204/18
Agreement between
the European Union
and the United States
of America on the
processing and
transfer of Financial
Messaging Data from
the European Union to
the United States for
purposes of the
Terrorist Finance
Tracking Program,
[2010] OJ L8/11
Reports by the High
Level Contact Group
(HLCG) on
information sharing
and privacy and
personal data
protection, 23
November 2009,
least the same level of privacy protection as is required by the relevant
Principles. If the organization complies with these requirements, it shall
not be held responsible (unless the organization agrees otherwise) when a
third party to which it transfers such information processes it in a way
contrary to any restrictions or representations, unless the organization
knew or should have known the third party would process it in such a
contrary way and the organization has not taken reasonable steps to
prevent or stop such processing.
Recital 3
DHS shall process PNR data received and treat data subjects concerned
by such processing in accordance with applicable US laws, constitutional
requirements, and without unlawful discrimination, in particular on the
basis of nationality and country of residence. The DHS’s letter sets forth
these and other safeguards.
Article 5, proving protections to personal data transferred from the EU to
the US for the purposes of the Terrorist Finance Tracking Program.
Principle 12
Where personal information is transmitted or made available by a
competent authority of the sending country or by private parties in
accordance with the domestic law of the sending country to a competent
authority of the receiving country, the competent authority of the
receiving country may only authorise or carry out an onward transfer of
this information to a competent authority of a third country if permitted
under its domestic law and in accordance with existing applicable
international agreements and international arrangements between the
sending and receiving country. In the absence of such international
agreements and international arrangements, such transfers should
moreover support legitimate public interests consisting of: national
security, defence, public security, the prevention, investigation, detection