Authorisation form - Commission nationale pour la protection des

Transcription

Authorisation form - Commission nationale pour la protection des
Commission Nationale pour la
Protection des Données
Grand-Duché de Luxembourg
Application form for a permit as defined in
article 19, paragraph (3) of the law of August 2, 2002
for transfers of personal data
•
to third countries (outside the European Union) which don’t provide an adequate level
of Protection within meaning of Article 18, paragraph (2) of the law of August 2nd,
2002 on the Protection of Persons with regard to the Processing of Personal Data.
(see table of countries on the Internet site of the European Commission below:
http://ec.europa.eu/justice/policies/privacy/thridcountries/index_en.htm )
Specific case: transfer of personal data to the United States of America
Personal data transfers to data importers based inside the United States of America who
adhered to the safe harbor framework developed by the Department of Commerce in
coordination with the European Commission are considered as providing the adequate level of
protection and no prior authorisation is required (see list of the adhered organizations on the
Internet site of the Department of Commerce of the United States:
(http://web.ita.doc.gov/safeharbor/shlist.nsf/webPages/safe+harbor+list).
and
•
if the data transfer cannot take place through one of the derogation cases listed in
Article 19, paragraph (1) of the law (derogations),
In accordance with Article 19, paragraph (3) of the law, the Commission nationale
can deliver to the data exporter an authorization for the transfer being the subject
of an application, which the exporter may introduce by filling out the following
form.
This application form should be completed, signed by the data exporter and addressed
to:
Commission nationale pour la protection des données
1, avenue du Rock'n'Roll
L-4361 Esch-sur-Alzette
Commission Nationale pour la Protection des Données
1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette
Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu
Data concerning the parties involved in the transfer
Data exporter
Name/denomination of the data exporter
Address of the data exporter
Please specify briefly your activities relevant to the intended transfer
Data importer
Name/denomination of the data importater
Address of the data importer
Please specify briefly his activities relevant to the intended transfer and his country of establishment.
Data subjects
Please specify the categories of data subjects concerned by the transfer of data. Where appropriate, a distinction
should be made according to the different types to data.
Commission Nationale pour la Protection des Données
1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette
Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu
2
Purpose(s) of the transfer
Please specify which purpose(s) the transfer is intended for. Where appropriate a distinction should be made
according to the different kind of data.
Categories of data
Please specify the categories of personal data being transferred.
Specific categories of data (e.g. data concerning health, data revealing racial origin,
political opinions, religious beliefs or trade union membership)
If appropriate, please specify the specific categories of data being transferred.
Recipients
Please specify the recipients or categories of recipients whom the data might be disclosed to
after the transfer. If appropriate, a distinction should be made according to the different categories of
data.
Commission Nationale pour la Protection des Données
1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette
Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu
3
Length of storage time
Please indicate the length of the time the transferred personal data are to be stored. If appropriate, a distinction
should be made according to the different categories of data.
Contact person
Please indicate the name and address of a contact person for the data exporter and the data importer
for further communication with the Commission nationale.
Basis for the permit
Which instruments have been used by the parties in order to adduce "sufficient guarantees in the respect
of the protection of the privacy, freedom and fundamental rights of the data subjects, as well as the
corresponding rights" for the intended data transfer?
A copy of the relevant parts of the used instruments should be sent together with this form, e.g. Standard
contractual clauses approved by the European Commission for such purposes used in a contract with
the data recipient, specific other contractual commitments and undertakings or Binding corporate rules
to be respected by the data recipient.
see the following links :
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2003/wp74_en.pdf
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp108_en.pdf
http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2005/wp107_en.pdf
Commission Nationale pour la Protection des Données
1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette
Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu
4
Have you made use of the model contracts approved by the European Commission ?
Yes ˜
No ˜
- If your answer is positive, please indicate the complete reference of the European Commission model contract
you have used :
- Have you added any provisions to the existing model contract?
Yes ˜
No ˜
If so, please indicate which ones :
- Have you amended any of the provisions of the model contract?
Yes ˜
No ˜
If so, please specify which one :
Have you used any other existing contract non-approved by the European Commission such as the ones
of the International Chamber of Commerce (ICC), Confederation of British Industry (CBI), Council
of Europe etc. ?
Yes ˜
No ˜
If so, please indicate which one :
Is the data recipient obliged to comply with Binding Corporate rules comprising specific data protection
commitments to be respected as an affiliate of a corporation/assocation/group of companies?
Yes
No
Commission Nationale pour la Protection des Données
1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette
Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu
5
If so, indicate which ones:
Additional information (not mandatory)
Have you, or your affiliates, demanded authorization in other EU Member States for a similar transfer,
on the basis of the same or a similar instrument?
Yes ˜
No ˜
If so, please specify in which Member State(s) :
Please use this space to indicate any additional information you would like to communicate to the
Commission nationale regarding this transfer.
Signature
Data exporter
The exporter hereby declares that all relevant documentation for the evaluation of the adequacy
of guarantees is sent to the Commission nationale together with this form.
Name:
Function:
Date:
Authorized signature:
Commission Nationale pour la Protection des Données
1, avenue du Rock'n'Roll | L-4361 Esch-sur-Alzette
Tél:(+352)26 10 60 1 | Fax:(+352)26 10 60 29 | www.cnpd.lu
6

Documents pareils