Transfer to the third countries not ensuring an adequate level of protection

Printer-friendly versionPrinter-friendly versionPDF verziaPDF verzia

For the transfer of personal data to the third country which does not ensure an adequate level of protection it is necessary to have an adequate legal basis, which is governed by the provisions of Section 31 Paragraph 2 or 3 of the Act on Personal Data Protection.

According to Section 31 Paragraph 2 of the Act the direct legal basis for the transfer to the third country which does not guarantee an adequate level of protection is the acceptance of assurances in the form of incorporation of a standard contractual clauses in the agreement on cross-border transfer or approval of binding corporate rules by the supervisory authority based in an EU member state. In addition to these legal bases for this case of cross-border transfer there are also individual and specific legal bases, which are defined exhaustively so they cannot be combined. This means that it is always possible to apply only one of the legal bases under Section 31 Paragraph 3 of the Act for the cross-border transfer to the third countries that do not guarantee the adequate level of protection.


Consent to the transfer of personal data to third countries that do not guarantee an adequate level of protection is required only in cases where the contract for the transfer of personal data does not include standard contractual clauses, will be in conflict with them or it shall circumvent them. In other words, if the standard contractual clauses are in any way modified or customized, so their text will not be identical to the official version it will be necessary to request the Office to consent to the transfer. In such case individual comparison, reviewing and the decision of the Office is needed by which the transfer of personal data shall be authorized or denied. To request the consent to the transfer is necessary before commencing the actual transfer. Issuing of the consent by the Office determines the transfer and replaces guarantees provided by the standard contractual clauses.


The standard contractual clauses are a part of the decision of the Commission from 5 February 2010 on standard contractual clauses for the transfer of personal data by the processors established in third countries under Directive of the European Parliament and Council Directive 95/46/EC and also the decision of the Commission from 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC.


If the controller wishes to carry out the transfer of personal data of its employees anywhere abroad it shall always be required to take adequate safeguards in the form of standard contractual clauses or binding corporate rules.

In case it is necessary to request the consent to transfer to the third country which does not guarantee the adequate level of protection, it is necessary that the applicant (the data exporter) states in the application:

  1. identification data of the contractual parties,
  2. the purpose of the transfer of personal data,
  3. assumed processing operations in a third country,
  4. a list of transferred personal data,
  5. group of the data subjects
  6. time-limit of personal data storage.

It is necessary to submit the contract for the transfer of personal data in the national language or in certified translation into the state language with as a part of the application.


In the context of cross-border transfer of personal data to third countries that do not guarantee the adequate level of protection, please take into notice also the following information:

  • Transfer of special categories of personal data is possible only with the prior written consent of the data subject, unless the special Act stipulates otherwise.
  • During each transfer of personal data their security must be ensured.

 

Desktop version
2018 Office for Personal Data Protection of the Slovak Republic