Regulation of Transborder Data Flows under ... - Tilburg University

Kuner/Regulation of Transborder Data Flows under Data Protection and Privacy Law 87
Name Source Text or translation (excerpts; notes are given in italics)
Infocomm
Development
Authority of
Singapore
(IDA) and the
National Trust
Council of
Singapore
(NTC)
Madrid
Resolution
Treasury
Board of
Canada
Voluntary Model Data
Protection Code for
the Private Sector
(Version 1.3 final)
International
Standards on the
Protection of Personal
Data and Privacy
(non-binding)
Taking Privacy into
Account before
Making Contracting
Decisions (2006)
and prosecution of criminal offences, breaches of ethics of regulated
professions, or the protection of the data subject. In all cases transfers
should be fully consistent with these common principles, especially the
limitation/purpose specification.
Principle 4.1.1
Where data are to be transferred to someone (other than the individual or
the organisation or its employees), the organisation shall take reasonable
steps to ensure that the data which is to be transferred will not be
processed inconsistently with this Model Code.
NOTE: The Implementation and Operational Guidelines to the provision
explain that ‘the restrictions on the onward transfers of personal data
under this principle apply to transfers to another organisation whether
the organisation is located in Singapore or not’.
15 International Transfers
1. As a general rule, international transfers of personal data may be
carried out when the State to which such data are transmitted affords, as a
minimum, the level of protection provided for in this Document.
2. It will be possible to carry out international transfers of personal data
to States that do not afford the level of protection provided for in this
document where those who expect to transmit such data guarantee that
the recipient will afford such level of protection; such guarantee may for
example result from appropriate contractual clauses. In particular, where
the transfer is carried out within corporations or multinational groups,
such guarantees may be contained in internal privacy rules, compliance
with which is mandatory.
3. Moreover, national legislation applicable to those who expect to
transmit data may permit an international transfer of personal data to
States that do not afford the level of protection provided for in this
Document, where necessary and in the interest of the data subject in the
framework of a contractual relationship, to protect the vital interests of
the data subject or of another person, or when legally required on
important public interest grounds.
Applicable national legislation may confer powers on the supervisory
authorities referred to in section 23 to authorize some or all of the
international transfers falling within their jurisdiction, before they are
carried out. In any case, those who expect to carry out an international
transfer of personal data should be capable of demonstrating that the
transfer complies with the guarantees provided for in this Document and
in particular where required by the supervisory authorities pursuant to the
powers laid down in paragraph 23.2.
Guidance which requires public bodies when contracting (including
situations when this will result in personal data being transferred outside
of Canada) to apply a context-specific test regarding the risk to privacy,
under which agencies are to evaluate the following factors:
--the sensitivity of the personal information, including whether the
information is detailed or highly personal, and the context in which it
was collected;
--the expectations of the individuals to whom the personal information
relates; and
--the potential injury if personal information is wrongfully disclosed or
misused, including the potential for identity theft or access by foreign
governments