Data Protection Directive and Compliance

| Sarbanes Oxley Training  |  Basel ii Training |  Data Protection Directive  |  Information Security  |  Privacy/Legal  |  Contact Us  |
   
Data Protection Awareness and Training
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data
 
Article 21
 
Publicizing of processing operations
 
1. Member States shall take measures to ensure that processing operations are publicized.
 
2. Member States shall provide that a register of processing operations notified in accordance with Article 18 shall be kept by the supervisory authority.
The register shall contain at least the information listed in Article 19 (1) (a) to (e).
The register may be inspected by any person.
 
3. Member States shall provide, in relation to processing operations not subject to notification, that controllers or another body appointed by the Member States make available at least the information referred to in Article 19 (1) (a) to (e) in an appropriate form to any person on request.
 
Member States may provide that this provision does not apply to processing whose sole purpose is the keeping of a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can provide proof of a legitimate interest.
 
 
 
CHAPTER III JUDICIAL REMEDIES, LIABILITY AND SANCTIONS
 
Article 22
 
Remedies
 
Without prejudice to any administrative remedy for which provision may be made, inter alia before the supervisory authority referred to in Article 28, prior to referral to the judicial authority, Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question.
 
 
 
Article 23
 
Liability
 
1. Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.
 
2. The controller may be exempted from this liability, in whole or in part, if he proves that he is not responsible for the event giving rise to the damage.
 
 
 
Article 24
 
Sanctions
 
The Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Directive and shall in particular lay down the sanctions to be imposed in case of infringement of the provisions adopted pursuant to this Directive.
 
 
 
CHAPTER IV TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
 
Article 25
 
Principles
 
1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.
 
2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.
 
3. The Member States and the Commission shall inform each other of cases where they consider that a third country does not ensure an adequate level of protection within the meaning of paragraph 2.
 
4. Where the Commission finds, under the procedure provided for in Article 31 (2), that a third country does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, Member States shall take the measures necessary to prevent any transfer of data of the same type to the third country in question.
 
5. At the appropriate time, the Commission shall enter into negotiations with a view to remedying the situation resulting from the finding made pursuant to paragraph 4.
 
6. The Commission may find, in accordance with the procedure referred to in Article 31 (2), that a third country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.
Member States shall take the measures necessary to comply with the Commission's decision.
 
 
 
Article 26
 
Derogations
 
1. By way of derogation from Article 25 and save where otherwise provided by domestic law governing particular cases, Member States shall provide that a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2) may take place on condition that:
 
(a) the data subject has given his consent unambiguously to the proposed transfer; or
 
(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of precontractual measures taken in response to the data subject's request; or
 
(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or
 
(d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or
 
(e) the transfer is necessary in order to protect the vital interests of the data subject; or
 
(f) the transfer is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case.
 
2. Without prejudice to paragraph 1, a Member State may authorize a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2), where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights; such safeguards may in particular result from appropriate contractual clauses.
 
3. The Member State shall inform the Commission and the other Member States of the authorizations it grants pursuant to paragraph 2.
 
If a Member State or the Commission objects on justified grounds involving the protection of the privacy and fundamental rights and freedoms of individuals, the Commission shall take appropriate measures in accordance with the procedure laid down in Article 31 (2).
Member States shall take the necessary measures to comply with the Commission's decision.
 
4. Where the Commission decides, in accordance with the procedure referred to in Article 31 (2), that certain standard contractual clauses offer sufficient safeguards as required by paragraph 2, Member States shall take the necessary measures to comply with the Commission's decision.
 
 

Article 1 to 4

Article 5 to 8

Article 9 to 12

Article 13 to 16

Article 17 to 20

Article 21 to 26

Article 27 to 30

Article 31 to 34

 

Return to Index

Our Web Sites

 

 

Sarbanes Oxley Training
Courses designed to provide with the knowledge and skills needed to understand and support Sarbanes-Oxley compliance.
www.sarbanes-oxley-training.com  
 
Basel ii Training
Courses designed to provide with the knowledge and skills needed to understand and support Basel ii compliance.
www.basel-ii-training.com 
 
Sarbanes Oxley Act
Sarbanes Oxley Compliance: Books, Software, Certification, Training and Resources.
www.sarbanes-oxley-act.biz 
 
Basel ii Accord
Basel ii Compliance: Books, Software, Certification, Training and Resources
http://www.basel-ii-accord.com/  
 
Compliance Training
Sarbanes Oxley, Basel ii, Data Protection Directive, Information Security Training
www.compliance-training.net
 
Legal Risk and Compliance
Legal Risk: The Achilles Heel of Corporate Governance.
Asbestos and Mesothelioma: The legal risk, the victims and the lawyers.
Employment related lawsuits.
http://www.legal-risk.com/
 
Compliance LLC
Compliance LCC is a company specializing in risk management, Sarbanes Oxley
and Basel ii compliance from an IT and Information Security perspective.
http://www.compliance-llc.com

 

 

© 2006 Copyright Compliance LLC Delaware USA ● www.compliance-llc.com ● Sarbanes Oxley Consulting
 Sarbanes Oxley Training ● Basel ii  Consulting ● Basel ii Training ● Compliance Research Projects