The transfer of a data subject's personal data to a third party country is allowed only if the country guarantees to individuals a sufficient level of protection in terms of privacy and fundamental rights and liberties.

The sufficiency of the protection is assessed by considering all the circumstances surrounding the transfer, in particular the nature of the data, the purpose and the duration of the proposed processing, country of origin and country of final destination, rules of law, both general and sectorial in force in the country in question and any relevant codes of conduct or other rules and security measures which are complied with in that country.

Data controllers may transfer personal data to a third country that is not deemed to offer adequate protection only if:

• the data subject consents and duly informed of the absence of adequate protection;
• the transfer is necessary:
  • for the performance of a contract between the data controller and the individual, or pre-contractual measures;
  • undertaken at the individual's request;
  • for the conclusion or the performance of a contract in the interest of the individual, between the data controllers and a third party;
  • for the protection of the public interest;
  • for consultation of a public register intended for the public's information;
  • to comply with obligations allowing the acknowledgment, the exercise or the defense of a legal right.

In all cases, the data recipient in the third party country cannot transfer personal data to another country, except with the authorisation of the first data controller and the CMIL.