The Data Protection Law stipulates that the international transfer of personal data is only permitted if the recipient country is considered to have adequate level of protection in respect of personal data processing.

The adequate level of protection for foreign countries is defined by the data protection authority.

As a general rule, the transfer of personal data to countries that do not provide for an adequate level of protection of personal data can only be permitted if the data subject has given his consent or in some specific situations, namely if the transfer:

• is necessary for the performance of an agreement between the data subject and the data controller or the implementation of precontractual measures taken in response to the data subject’s request

• is necessary for the performance or execution of a contract entered into or to be entered into in the interest of the data subject between the controller and a third party

• is necessary in order to protect the vital interests of the data subject

• is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, provided the conditions laid down in law for consultation are fulfilled in the particular case.