Article 17
Exceptions
- In derogation from Article 16 paragraphs 1 and 2, personal data may be disclosed abroad in the following cases:
- a. The data subject has explicitly consented to disclosure.
- b. Disclosure is directly connected with the conclusion or performance of a contract:
- between the controller and the data subject; or
- between the controller and its contractual partner in the interests the data subject.
- c. Disclosure is necessary in order to:
- safeguard an overriding public interest; or
- establish, exercise or enforce legal rights before a court or another competent foreign authority.
- d. Disclosure is necessary to protect the life or the physical integrity of the data subject or a third party, and it is not possible to obtain the consent of the data subject within a reasonable time.
- e. The data subject has made the data generally accessible and has not explicitly prohibited processing.
- f. The data originate from a statutory register that is public or accessible to persons with a legitimate interest, provided the statutory requirements for access are met in the case concerned.
- The controller or the processor shall inform the FDPIC on request about the disclosure of personal data under paragraph 1 letters b number 2, c and d.