Prior authorization from the National Commission is required before any transfer of personal data to a foreign state.

Further, the person in charge of the processing operation can transfer personal data to a foreign state only if the said state ensures under its applicable legal framework an adequate level of protection for the privacy and fundamental rights and freedoms of individuals regarding the processing to which these data is or might be subject, unless:

• The data subject has expressly consented to the transfer

• The transfer and subsequent processing is required for:

• Compliance with a legal obligation to which the concerned person or the person in charge of the processing are submitted

• The execution of a contract to which the concerned person is party or in the performance of pre-contractual measures taken at the request of the latter

• The protection of the vital interests of the relevant data subject, if that person is physically or legally unable to give its consent

• Performance of a task of public interest or related to the exercise of public authority, vested in the person in charge of the processing or the third party to whom the data are communicated

• Fulfillment of the legitimate interests pursued by the data controller or by the recipient, when not outweighed by the interests or fundamental rights and freedoms of the relevant data subject

In practice, we notice that CNDP interprets the exception of legitimate interests of the data processor very restrictively. CNDP is in general more comfortable relying on the data subject’s consent regarding any transfers to a foreign state.