“Article 14 – Transborder flows of personal data”.
2.The text of Article 12 of the Convention (new Article 14) shall be replaced by the following:- “1.
- A Party shall not, for the sole purpose of the protection of personal data, prohibit or subject to special authorisation the transfer of such data to a recipient who is subject to the jurisdiction of another Party to the Convention. Such a Party may, however, do so if there is a real and serious risk that the transfer to another Party, or from that other Party to a non-Party, would lead to circumventing the provisions of the Convention. A Party may also do so if bound by harmonised rules of protection shared by States belonging to a regional international organisation.
- 2.
- When the recipient is subject to the jurisdiction of a State or international organisation which is not Party to this Convention, the transfer of personal data may only take place where an appropriate level of protection based on the provisions of this Convention is secured.
- 3.
- An appropriate level of protection can be secured by:
- a)the law of that State or international organisation, including the applicable international treaties or agreements; or
- b)ad hoc or approved standardised safeguards provided by legally-binding and enforceable instruments adopted and implemented by the persons involved in the transfer and further processing.
- 4.
- Notwithstanding the provisions of the previous paragraphs, each Party may provide that the transfer of personal data may take place if:
- a)the data subject has given explicit, specific and free consent, after being informed of risks arising in the absence of appropriate safeguards; or
- b)the specific interests of the data subject require it in the particular case; or
- c)prevailing legitimate interests, in particular important public interests, are provided for by law and such transfer constitutes a necessary and proportionate measure in a democratic society; or
- d)it constitutes a necessary and proportionate measure in a democratic society for freedom of expression.
- 5.
- Each Party shall provide that the competent supervisory authority, within the meaning of Article 15 of this Convention, is provided with all relevant information concerning the transfers of data referred to in paragraph 3, littera b and, upon request, paragraph 4, litterae b and c.
- 6.
- Each Party shall also provide that the supervisory authority is entitled to request that the person who transfers data demonstrates the effectiveness of the safeguards or the existence of prevailing legitimate interests and that the supervisory authority may, in order to protect the rights and fundamental freedoms of data subjects, prohibit such transfers, suspend them or subject them to conditions.”
