Transfer of data to a third party jurisdiction is allowed provided that the third party jurisdiction to which the data is to be transferred ensures appropriate levels of protection.

Transfer to jurisdictions with inadequate protection is permissible with the authorization of the ECA if:

• the data subject consents to the transfer of the data to the third-party jurisdiction; and
• there is appropriate severance or reduction of those aspects of the data which it deems appropriate.