1 Personal data may be disclosed abroad if the Federal Council has decided that the legislation of the State concerned or the international body guarantees an adequate level of protection.
2 In the absence of a decision by the Federal Council under paragraph 1, personal data may be disclosed abroad only if an appropriate level of data protection is guaranteed by:
- a.
a treaty under international law;
- b.
data protection clauses in an agreement between the controller or the processor and its contractual partner, notice of which has been given to the FDPIC beforehand;
- c.
specific guarantees drawn up by the competent federal body, notice of which has been given to the FDPIC beforehand;
- d.
standard data protection clauses that the FDPIC has approved, issued or recognised beforehand; or
- e.
binding corporate rules that have been approved in advance by the FDPIC or by the authority responsible for data protection in a State that guarantees an adequate level of protection.
3 The Federal Council may provide for other appropriate guarantees in line with paragraph 2.