Data transfers

Transfer of personal data

Article 32.  Transborder transfer of personal data Law 133 on personal data protection

(1) This article shall apply to the transfer to another state, regardless of used medium or means, of personal data undergoing processing or are intended for processing.
(2) Personal data intended for transfer to another state shall be protected in accordance with this law.
(3) Transborder transmission of personal data undergoing processing or are intended for processing after transfer may take place only with the authorization of the Centre, as provided for by law, and only if the country of destination ensures an adequate level of protection of personal data subjects’ rights and of data intended for transfer.
(4) The level of protection shall be established by the Centre taking into account the conditions in which personal data transmission takes place, especially the nature of data, the purpose and duration of processing or intended processing, the country of destination, the legislation in force in the country in question and the professional rules and security measures which are complied with in the country of destination.
(5) Where the Centre considers that the country of destination does not ensure an adequate level of protection, it shall prevent any transfer of data.
(6) The Centre may authorise, as provided for by law, the transfer of personal data to another state, which legislation does not ensure at least the same level of protection as the one offered by the law of the Republic of Moldova, where the controller provides sufficient guarantees regarding the protection and the exercise of the personal data subjects’ rights, that are laid down by contracts concluded between controllers and natural or legal persons, on which provision the transfer is carried out.
(7) The provisions referred to in paragraphs (3)-(6) shall not apply where the transfer of personal data takes place in terms of the provisions of a special law or of an international treaty ratified by the Republic of Moldova, in particular if the transfer is necessary for the purpose of preventing and investigating crimes. The special law or the international treaty must contain guarantees regarding the protection of personal data subject’s rights.
(8) The provisions referred to in paragraphs (1)-(6) shall not apply where the processing of personal data is carried out solely for journalistic, artistic or literary purposes, if such data are voluntarily and manifestly made public by the personal data subject or if they are closely related to the personal data subject’s status of a public person or to the public nature of the acts in which he is involved.
(9) Transmission of personal data to states that do not ensure an adequate level of protection may take place only:
a) with the personal data subject’s consent;
b) if the transfer is necessary for the conclusion or performance of an agreement or contract concluded between the personal data subject and the controller or between the controller and a third party in the interest of the personal data subject;
c) if the transfer is necessary in order to protect the life, physical integrity or health of the personal data subject;
d) if transfer is made from a register which according to the law is intended to provide information to the public and which is open to consultation either by the public or by any person who demonstrates a legitimate interest, to the extent that the conditions for consultation in particular cases laid down in law are fulfilled;
e) if the transfer is necessary for the accomplishment of an important public interest, such as national defense, national security or public order, carrying out in good order a criminal trial or ascertaining, exercising or defending a right in court, on the condition that the personal data is processed solely in relation to this purpose and only for period is necessary to achieve it.

NCPDP decision from 2015 regarding the establishment of cases in which it is not necessary to authorize the transborder transmission of personal data