Transfer of personal data to third countries
1. Transfer to Member States of the European Union
2. Transfer to countries outside the European Union
3. Information material
4. Examples from practice
1. Transfer of data within the European Union
The Wet bescherming persoonsgegevens (Wbp; Dutch Data Protection Act) does not have any individual provisions governing data movements within the European Union (EU), as the Wbp implements the European Directive for the Dutch jurisdiction.
This directive 95/46/EC has two objectives:
- an equivalent protection of personal data, and
- free movement of personal data within the European Union.
The European Union will thus be one single jurisdiction with regard to the protection of personal data once all Member States have adapted their legislation to the directive.
Data movement from the Netherlands to another EU Member State thus only has to conform to the general requirements of the Wbp.
2. Transfer to countries outside the European Union
The Wbp has specific provisions for the movement of data to countries outside the European Union, the third countries (Chapter 11 Wbp). Third countries are all countries outside the European Union, with the exception of the countries of the European Economic Area (EEA). The countries of the EEA (Norway, Liechtenstein and Iceland) have undertaken to implement the directive in their own legislation.
Appropriate level of protection
The primary rule is that personal data may only be transferred to a third country if the general requirements of the Wbp have been conformed to and the third country ensures an adequate level of protection.
For a number of countries, the European Commission has adopted decisions regarding the adequacy of the level of protection.
No adequate level of protection
If a third country does not provide an adequate level of protection, there are two possibilities for still being entitled to transfer data to these third countries.
- transfer based on the exceptions mentioned in the Act (Article 77(1) Wbp).
- transfer based on a permit of the Minister of Justice. Such a permit will be made subject to additional conditions that serve as a guarantee for the protection of personal data. To apply for the permit, a form (PDF file) must be used.
The granting of such a permit will be facilitated if the model contracts prepared by the European Commission are used for the transfer.
3. Information material
The Dutch DPA has various information materials regarding the transfer of personal data to third countries.
4. Examples from practice
The most illustrative case in 2001 related to the transfer of data in the take-over of the auction web site iBazar by the American E-Bay.