g-docweb-display Portlet

Authorisation to Transfer Personal Data from the State's Territory to Third Countries ' June 9, 2005 [1214121]

Stampa Stampa Stampa
PDF Trasforma contenuto in PDF

[doc. web n. 1214121]

[ doc. web n. 1151949]

Authorisation to Transfer Personal Data from the State´s Territory to Third Countries – June 9, 2005
(published in the Official Journal no. 171 of July 25, 2005)


THE GARANTE PER LA PROTEZIONE DEI DATI PERSONALI

Prof. Francesco Pizzetti, President, Mr. Giuseppe Chiaravalloti, Vice-President, Mr. Mauro Paissan and Mr. Giuseppe Fortunato, Members, and Mr. Giovanni Buttarelli, Secretary General, having convened today;

Having regard to Article 25(1) and (2) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995, providing that personal data may be transferred to a country outside the European Union if the third country in question ensures an adequate level of protection;

Having regard to Article 26 of the aforementioned Directive, laying down derogations from the said principle and also providing that a Member State may authorize a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection, where the data controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights, such safeguards also resulting from appropriate contractual clauses;

Having regard to Article 26(4) concerning the European Commission´s decisions on standard contractual clauses;

Whereas the European Commission laid down, in its decision no. 2001/497/EC of June 15, 2001, an initial set of standard contractual clauses annexed thereto, which offer sufficient safeguards with regard to the protection of privacy and fundamental rights and freedoms of individuals as well as in view of the exercise of the corresponding rights for the transfer of personal data to third countries pursuant to directive 95/46/EC;

Having regard to the European Commission´s decision no. 2004/915/EC of December 27, 2004 as published in the Official Journal of the EC L385/74 of December 29, 2004, which amended the said Commission´s decision no. 2001/497/EC and introduced an alternative set of standard contractual clauses, annexed to the said decision, which in the Commission´s view also offer sufficient safeguards with regard to the protection of privacy, fundamental rights and freedoms of individuals as well as in view of the exercise of the corresponding rights for the transfer of personal data to third countries pursuant to directive 95/46/EC;

Whereas Member States are required to take the necessary measures to comply with the Commission´s Decision in pursuance of the said Article 25(6) of the directive;

Having regard to Sections 43, 44 and 45 of the Personal Data Protection Code (legislative decree no. 196/2003), whereby the transfer of personal data to third countries may take place under any of the circumstances referred to in Section 43, or else if it is authorised by the Garante pursuant to Section 44(1) and Section 45 on the basis of adequate safeguards for the data subject´s rights, which (a) may be found by the Garante also with regard to contractual safeguards, or (b) may be set out in decisions adopted by the EU Commission pursuant to Section 25(6) and Section 26(4) of Directive 95/46/EC; apart from the cases referred to in Sections 43 and 44, the transfer may take place (c) if the laws of the country of destination or transit of the data ensure an adequate level of protection of individuals within the meaning of Section 45 of the Personal Data Protection Code;

Having regard to Resolution no. 35 of October 10, 2001 whereby this Authority authorised the transfer of personal data from the State´s territory to third countries in pursuance of the standard contractual clauses annexed to the Commission´s decision no. 2001/497/EC, which are currently referred to as "Set I" in pursuance of Article 1(4) of the Commission´s decision no. 2004/915/EC; 
Whereas the standard contractual clauses contained in "Set II" of the Annex to decision no. 2004/915/EC, which are the subject of the Commission´s finding, envisage safeguards for data subjects´ rights that are to be regarded as adequate in the light of the aforementioned Section 44(1), letter b);

Whereas the Commission´s decision only concerns adequacy of the data protection afforded by using the standard contractual clauses whenever a data controller established in the Community (data exporter) transfers data from the State´s territory to another data controller (data importer) that is resident in a third country where no adequate level of protection is afforded;

Whereas any entity intending to avail itself of the standard contractual clauses may select either of the Sets – I or II – contained in the Annex to the Commission´s decision no. 2001/497/EC as amended by Article 1 of decision no. 2004/915/EC;

Whereas any entity availing itself of the said clauses may neither amend them nor merge individual clauses or the aforementioned sets;

Whereas it is necessary to further publicise the standard contractual clauses referred to in "Set II" by having them published in the Official Journal of the Italian Republic as an Annex to this authorisation;

Whereas it is necessary to set forth some provisions relating to the information to be made available to the Garante by having regard to the tasks committed to it that are mentioned in the aforementioned decision by the Commission, insofar as such provisions are required in the initial implementing phase hereof within the meaning specified hereunder;

Whereas the Garante hereby reserves the right to perform, on a case by case basis, the mediation role referred to in Clause V, letter b), of decision no. 2004/915/EC;

Whereas the Garante hereby reserves the right to set forth additional criteria and mechanisms on the basis of the experience gathered in applying the clauses, also at Community level;

Having regard to official records;

Having regard to the considerations made by the Secretary General on behalf of the Office in pursuance of Article 15 of the Garante´s Regulations no. 1/2000;

Acting on the report submitted by Mr. Giuseppe Chiaravalloti;


BASED ON THE ABOVE PREMISES:

1) Subject to application of the additional measures set out in the Personal Data Protection Code, hereby authorises the transfer of personal data from the State´s territory to non-EU Member States as of April 1, 2005, where performed in compliance with the standard contractual clauses contained in the Annex to the European Commission´s decision no. 2004/915/EC of December 27, 2004 as well as pursuant to the prerequisites specified therein;

2) Orders that:

a) a copy of the contract relating to the transfer and any other necessary information be only provided to the Garante at the latter´s request (Clause 1, letter e), and Section 157 of the Code);

b) the choice made in case of a dispute that is not settled friendly and is submitted to an entity other than either the Garante or a judicial authority be communicated to the Garante (Clause 5 and Section 157 of the Code);

3) Reserves the right to perform the necessary controls on lawfulness and fairness of data transfers and issue provisions to block and/or prohibit the transfer pursuant to the Personal Data Protection Code as well as to Community legislation (Article 4 of the European Commission´s decision no. 2001/497/EC as amended by Article 1(2) of decision no. 2004/915/EC);

4) Orders that this authorisation and the Commission´s Decision annexed hereto be sent to the Publishing Department of the Ministry of Justice for them to be published in the Official Journal of the Italian Republic.


Done in Rome, this 9th day of June 2005.


THE CHAIRMAN
Pizzetti

THE RAPPORTEUR
Chiaravalloti

THE SECRETARY GENERAL
Buttarelli

 


ANNEX
European Commission´s Decision of December 27, 2004 amending decision no. 2001/497/EC  concerning the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries.



Vedi anche (10)