AndorraLQPD, transfers of personal data to third countries or international organisations
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- none
What it requires
- Before transferring personal data to a country or international organisation outside Andorra, confirm the destination offers an adequate level of protection under Article 43, or put appropriate safeguards in place under Article 44, such as standard data-protection clauses or binding corporate rules.NIST Privacy FrameworkCT.PO-P2
- Where no adequacy finding or appropriate safeguard applies, transfer personal data only under an Article 45(1) derogation, such as the data subject's informed explicit consent or contractual necessity, or, failing that, only under Article 45(2)'s narrow compelling-legitimate-interest exception, informing the Agency and the data subject.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkCM.AW-P1
- Expect the Agency's adequacy and safeguards assessment to weigh the destination's rule of law and human rights record, its data protection and professional rules and security measures, and whether data subjects there have effective, enforceable rights and redress.
- Document in your processing register the assessment and safeguards behind any transfer you make under Article 45(2).NIST Privacy FrameworkID.IM-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 45(3) makes a controller or processor that relies on the compelling-legitimate-interest exception of Article 45(2) document its assessment and the safeguards it offered in its register of processing activities. The register itself is the Article 34 duty, which this row does not cite, so the register's own access rule (Article 34(7), on the Agency's request) is not borrowed and the audit keys are none; Article 45(2) also has the controller inform the Agency and the data subject of such a transfer, which is a notification and no record. Articles 42 to 44 impose no record duty. The record's contents (an assessment and safeguards) are not log content values.
- Kind
- Explicit
- As of
- Provision
- Article 45(3) (documenting the assessment and safeguards in the register of processing activities)
- Trigger
- personal_data_processing
What this law does
Article 42(1) bars international transfers of personal data where the destination country's or international organisation's rules do not establish a level of protection for personal data at least equivalent to this law's own. Article 43 treats a country, territory or sector the European Union has found adequate, or a state effectively subject to Council of Europe Convention 108+, as offering an adequate level of protection, and treats every European Union member state as offering one.
Article 44 lets a transfer proceed without an adequacy finding where appropriate safeguards exist and data subjects have enforceable rights and effective legal remedies, evidenced by a binding legal instrument between public authorities, binding corporate rules, standard data-protection clauses, a code of conduct with binding commitments, an approved certification mechanism with binding commitments, contractual clauses, or administrative arrangements with enforceable data-subject rights.
Article 44(2) directs the Andorran Data Protection Agency to weigh the rule of law and human rights record, relevant general and sectoral legislation including public-authority access to personal data, data protection and professional rules and security measures, case law, and effective administrative and judicial redress for data subjects, in assessing whether those safeguards are adequate.
Article 45(1) lets a transfer proceed without an adequacy finding or appropriate safeguards only under a listed derogation, including the data subject's informed explicit consent, contractual necessity, important public interest, legal claims, or vital interests.
Article 45(2) lets a transfer proceed on compelling legitimate interests where no adequacy finding, safeguard or Article 45(1) derogation applies, but only if it is not repetitive, affects a limited number of data subjects, and the controller has assessed the circumstances, offered adequate safeguards, and informed both the supervisory authority and the data subject.
Article 12 exempts processing for academic, artistic or literary expression, or professional journalistic activity, from this whole transfer chapter, to the extent necessary to reconcile data protection with freedom of expression and information.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .