Transfers of personal data

General derogations
- Explicit informed consent has been obtained, or
- Transfer is necessary (for performance of contract, public interest, etc.), or
- Transfer is made from a register to provide information to the public
Derogation for legitimate interests of the controller if (cumulative conditions)
- Not possible on any other previous ground (adequacy, appropriate safeguards, derogations)
- Transfer is not repetitive and concerns only a limited number of data subjects
- is necessary for the purposes of compelling legitimate interests pursued by the controller
- These purposes are not overridden by data subject’s interests or rights
- Controller has assessed impact and provided for safeguards
- Controller shall inform the supervisory authority of the transfer