Exceptions

¹ In derogation from Article 16 paragraphs 1 and 2, personal data may be disclosed abroad in the following cases:

• a.

  The data subject has explicitly consented to disclosure.

• b.

  Disclosure is directly connected with the conclusion or performance of a contract:

  • 1.

    between the controller and the data subject; or

  • 2.

    between the controller and its contractual partner in the interests the data subject.

• c.

  Disclosure is necessary in order to:

  • 1.

    safeguard an overriding public interest; or

  • 2.

    establish, exercise or enforce legal rights before a court or another competent foreign authority.

• d.

  Disclosure is necessary to protect the life or the physical integrity of the data subject or a third party, and it is not possible to obtain the consent of the data subject within a reasonable time.

• e.

  The data subject has made the data generally accessible and has not explicitly prohibited processing.

• f.

  The data originate from a statutory register that is public or accessible to persons with a legitimate interest, provided the statutory requirements for access are met in the case concerned.

² The controller or the processor shall inform the FDPIC on request about the disclosure of personal data under paragraph 1 letters b number 2, c and d.