Transfers of personal data

  • General derogations
    • Explicit informed consent has been obtained, or
    • Transfer is necessary (for performance of contract, public interest, etc.), or
    • Transfer is made from a register to provide information to the public
  • Derogation for legitimate interests of the controller if (cumulative conditions)
    • Not possible on any other previous ground (adequacy, appropriate safeguards, derogations)
    • Transfer is not repetitive and concerns only a limited number of data subjects
    • is necessary for the purposes of compelling legitimate interests pursued by the controller
    • These purposes are not overridden by data subject’s interests or rights
    • Controller has assessed impact and provided for safeguards
    • Controller shall inform the supervisory authority of the transfer