Transfer of personal data
Article 32. Cross-border transfer and free movement of personal data – Law no. 133/2011 on personal data protection
(1) This Article shall apply in the case of the transmission to another state of personal data which are processed.
(2) The transmission of personal data shall be permitted and carried out, taking into account the principle of free movement of data, to:
a) the Member States of the European Economic Area;
b) States that ensure an adequate level of protection of personal data.
(3) The Center shall approve, by decision, the list of States ensuring an adequate level of data protection, taking into account: the international treaties on the protection of personal data to which they are party; the existence and compatibility of data protection legislation; competences and cooperation with the data processing supervisor, as well as other important aspects regarding the legal regime of personal data protection. The Center shall take into account the decisions taken by the European Commission regarding the states that ensure an adequate level of protection of personal data.
(4) The list of states that ensure an adequate level of data protection shall be published in the Official Gazette of the Republic of Moldova and on the official website of the Center.
(5) The transmission of personal data to States which do not provide an adequate level of protection may take place:
a) if the processing takes place on the basis of an agreement or treaty signed between the Republic of Moldova and the country of destination;
b) with the consent of the data subject, with information on the possible risks that such transfers may involve for the data subject due to the lack of a decision on the adequacy of the level of protection and adequate safeguards;
c) in case of the need to conclude or execute an agreement or contract between the subject of personal data and the controller or between the controller and a third party in the interest of the subject of personal data;
d) if it is necessary to protect the life, physical integrity or health of the subject of personal data;
e) if journalistic, artistic, scientific, literary or archival purposes are pursued in the public interest;
f) to other companies or organizations from the same group with the controller, provided that the obligatory corporate rules are observed, approved by the states indicated in par. (2) lit. a), or those approved by the Center;
g) if it is necessary for the satisfaction of a major public interest, such as national defense, state security or public order, for the proper conduct of criminal proceedings or for the establishment, exercise or defense of a right in court, provided that personal data are processed in connection with this purpose and only for the period necessary to achieve this purpose;
h) whether the transfer is necessary for the establishment, exercise or defense of a right in court, whether in the context of a judicial proceeding or in the context of an administrative or extrajudicial proceeding, including in proceedings before the regulatory authorities;
i) if the processing takes place on the basis of the standard contract for the cross-border transmission of personal data, developed and approved by the Center, concluded by the controller.
[Art.32 in wording of LP175 of 11.11.21, MO302-306/10.12.21 art.431; in force 10.01.22]
