Transfers to other states

The general rule

Personal data may be transferred to another state or to an international organisation only if the controller and the processor comply with the conditions of the Chapter on transfers, including for onward transfers from that state art. 44(1). The aim is to ensure that the level of protection guaranteed by the Law is not undermined when data leaves the country.

The Chapter does not apply to transfers to member states of the European Economic Area, and no special authorisation is needed for them art. 44(2). The other obligations of the Law continue to apply to all processing.

Adequacy decisions

A transfer is carried out where the National Centre for Personal Data Protection decides that the state, a territory or a sector within it, or the international organisation, ensures an adequate level of protection; such a transfer requires no special authorisation art. 45(1). In its assessment, the Centre takes into account, among other things, the decisions of the European Commission on the adequacy of the level of protection art. 45(2)(d). The list of states and organisations for which it has decided that the level of protection is, or is no longer, adequate is published in the Official Gazette of the Republic of Moldova (Monitorul Oficial) and on the Centre’s website art. 45(8). The Centre also monitors, on an ongoing basis, the adequacy decisions issued before the Law entered into force art. 45(4), and the Centre’s acts issued under art. 32(3) and (5)(f) and (i) of Law No. 133/2011, the article on cross-border transfers, remain in force art. 90(5).

Appropriate safeguards

In the absence of a decision, a transfer is possible only if the controller or processor provides appropriate safeguards and data subjects have enforceable rights and effective legal remedies art. 46(1). Without specific authorisation from the Centre, the safeguards may be provided only by the instruments the Law lists: a binding and enforceable legal act between public authorities or institutions, binding corporate rules, standard data protection clauses approved by the Centre or adopted by the European Commission, or an approved code of conduct or certification mechanism together with a binding and enforceable commitment of the controller or processor in the other state art. 46(2). Contractual clauses agreed directly with the recipient and administrative arrangements between authorities require the Centre’s authorisation art. 46(3).

Binding corporate rules allow transfers within a group of enterprises and are approved by the Centre if they meet the requirements of the Law art. 47(1).

Derogations for specific situations

If there is neither a decision nor appropriate safeguards, a transfer may take place only in one of the situations listed in the Law art. 49(1). They include the explicit consent of the data subject, given after being informed of the risks art. 49(1)(a), and a transfer necessary for the performance of a contract with the data subject art. 49(1)(b).

As a last resort, a transfer that is not repetitive and concerns a limited number of data subjects may take place if it is necessary for the substantial legitimate interests of the controller, which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances and provided appropriate safeguards. The controller informs the Centre and the data subject of the transfer art. 49(2) and documents the assessment in the records of processing activities art. 49(7).

Requests from foreign authorities

A judgment of a court or a decision of an authority of another state requiring the transfer or disclosure of data may be recognised or enforced only if it is based on an international treaty, such as a mutual legal assistance treaty in force between the requesting state and the Republic of Moldova, without prejudice to the other grounds for transfer in Chapter V art. 48. The Centre cooperates with authorities in other states to enforce the legislation effectively art. 50.

Why it matters

The data subject must be informed of any intention to transfer data to another state and of the basis for the transfer art. 13(1)(f). Infringements of the rules on transfers are punishable by fines of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover, whichever is higher art. 88(2)(c).