Authorisation form - Commission nationale pour la protection des
Transcription
Authorisation form - Commission nationale pour la protection des
Commission Nationale pour la Protection des Données Grand-Duché de Luxembourg Application form for a permit as defined in article 19, paragraph (3) of the law of August 2, 2002 for transfers of personal data • to third countries (outside the European Union) which don’t provide an adequate level of Protection within meaning of Article 18, paragraph (2) of the law of August 2nd, 2002 on the Protection of Persons with regard to the Processing of Personal Data. (see table of countries on the Internet site of the European Commission below: http://ec.europa.eu/justice/policies/privacy/thridcountries/index_en.htm ) Specific case: transfer of personal data to the United States of America Personal data transfers to data importers based inside the United States of America who adhered to the safe harbor framework developed by the Department of Commerce in coordination with the European Commission are considered as providing the adequate level of protection and no prior authorisation is required (see list of the adhered organizations on the Internet site of the Department of Commerce of the United States: (http://web.ita.doc.gov/safeharbor/shlist.nsf/webPages/safe+harbor+list). and • if the data transfer cannot take place through one of the derogation cases listed in Article 19, paragraph (1) of the law (derogations), In accordance with Article 19, paragraph (3) of the law, the Commission nationale can deliver to the data exporter an authorization for the transfer being the subject of an application, which the exporter may introduce by filling out the following form. This application form should be completed, signed by the data exporter and addressed to: Commission nationale pour la protection des données 1, avenue du Rock'n'Roll L-4361 Esch-sur-Alzette Commission Nationale pour la Protection des Données 1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu Data concerning the parties involved in the transfer Data exporter Name/denomination of the data exporter Address of the data exporter Please specify briefly your activities relevant to the intended transfer Data importer Name/denomination of the data importater Address of the data importer Please specify briefly his activities relevant to the intended transfer and his country of establishment. Data subjects Please specify the categories of data subjects concerned by the transfer of data. Where appropriate, a distinction should be made according to the different types to data. Commission Nationale pour la Protection des Données 1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu 2 Purpose(s) of the transfer Please specify which purpose(s) the transfer is intended for. Where appropriate a distinction should be made according to the different kind of data. Categories of data Please specify the categories of personal data being transferred. Specific categories of data (e.g. data concerning health, data revealing racial origin, political opinions, religious beliefs or trade union membership) If appropriate, please specify the specific categories of data being transferred. Recipients Please specify the recipients or categories of recipients whom the data might be disclosed to after the transfer. If appropriate, a distinction should be made according to the different categories of data. Commission Nationale pour la Protection des Données 1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu 3 Length of storage time Please indicate the length of the time the transferred personal data are to be stored. If appropriate, a distinction should be made according to the different categories of data. Contact person Please indicate the name and address of a contact person for the data exporter and the data importer for further communication with the Commission nationale. Basis for the permit Which instruments have been used by the parties in order to adduce "sufficient guarantees in the respect of the protection of the privacy, freedom and fundamental rights of the data subjects, as well as the corresponding rights" for the intended data transfer? A copy of the relevant parts of the used instruments should be sent together with this form, e.g. Standard contractual clauses approved by the European Commission for such purposes used in a contract with the data recipient, specific other contractual commitments and undertakings or Binding corporate rules to be respected by the data recipient. see the following links : http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2003/wp74_en.pdf http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp108_en.pdf http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp107_en.pdf Commission Nationale pour la Protection des Données 1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu 4 Have you made use of the model contracts approved by the European Commission ? Yes ˜ No ˜ - If your answer is positive, please indicate the complete reference of the European Commission model contract you have used : - Have you added any provisions to the existing model contract? Yes ˜ No ˜ If so, please indicate which ones : - Have you amended any of the provisions of the model contract? Yes ˜ No ˜ If so, please specify which one : Have you used any other existing contract non-approved by the European Commission such as the ones of the International Chamber of Commerce (ICC), Confederation of British Industry (CBI), Council of Europe etc. ? Yes ˜ No ˜ If so, please indicate which one : Is the data recipient obliged to comply with Binding Corporate rules comprising specific data protection commitments to be respected as an affiliate of a corporation/assocation/group of companies? Yes No Commission Nationale pour la Protection des Données 1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu 5 If so, indicate which ones: Additional information (not mandatory) Have you, or your affiliates, demanded authorization in other EU Member States for a similar transfer, on the basis of the same or a similar instrument? Yes ˜ No ˜ If so, please specify in which Member State(s) : Please use this space to indicate any additional information you would like to communicate to the Commission nationale regarding this transfer. Signature Data exporter The exporter hereby declares that all relevant documentation for the evaluation of the adequacy of guarantees is sent to the Commission nationale together with this form. Name: Function: Date: Authorized signature: Commission Nationale pour la Protection des Données 1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu 6