LiechtensteinGDPR Chapter V and DSG Transfer Provisions (Articles 77 to 80 and 84), Cross-Border Transfers in Liechtenstein
Datenschutzgesetz (DSG) LGBl. 2018 Nr. 272, Articles 77 to 80, 84 and 85; Regulation (EU) 2016/679, Articles 44 to 49; EEA Joint Committee Decision No. 154/2018
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Before moving personal data of a person in Liechtenstein to a country outside the European Economic Area, meet a condition of General Data Protection Regulation (GDPR) Chapter V, such as an adequacy decision under Article 45 or appropriate safeguards under Article 46.
These lines are LexLint's reading of the law's text. Also read by: Datenschutzstelle (Data Protection Authority) of the Principality of Liechtenstein (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.datenschutzstelle.li/rechtsgrundlagen/faqs-zur-dsgvo
- Guidance body
- Datenschutzstelle (Data Protection Authority) of the Principality of Liechtenstein
- Open questions
- Which Article 46 safeguard may an exporter in Liechtenstein rely on for a transfer to an importer in a third country whose processing of the data is subject to Regulation (EU) 2016/679 under its Article 3(2), given that Article 1 of Decision 2021/914 covers only importers whose processing is not subject to that Regulation?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Access record
Logging duty
In the criminal-justice field the controller must document a transfer to a third country made on its own assessment that appropriate safeguards exist (Article 78(1)(b)), and Articles 79(3) and 80(3) apply the same duty to transfers without safeguards and to transfers to private recipients. The documentation holds the time of the transfer, the identity of the recipient, the reason for it and the data transferred, and the Datenschutzstelle can ask for it. The yearly notice to the Datenschutzstelle in Article 78(3) is the controller's own report, not a review of the record. GDPR Articles 44 to 49 and Articles 84 and 85 of the Act set no record duty. The cited articles have no scope clause, so no territorial hook is coded.
- Kind
- Explicit
- As of
- Provision
- DSG Article 78(2), applied to Articles 79 and 80 by Articles 79(3) and 80(3)
- Trigger
- personal_data_processing
What this law does
Article 44 of the General Data Protection Regulation (GDPR) permits a transfer of personal data to a third country or international organization only if the conditions of Chapter V are complied with by the controller and processor. The Datenschutzgesetz states that it does not apply insofar as EEA law, in particular the GDPR, applies directly.
Article 85 of the Datenschutzgesetz has the Government make ordinances, among other matters, on the adequacy decisions of the EU Commission under GDPR Article 45 and the standard data protection clauses under GDPR Article 46 that apply in Liechtenstein. Chapter III of the Datenschutzgesetz applies to processing by public bodies for the prevention, investigation, detection or prosecution of criminal offenses or the execution of penalties.
Article 77 of the Datenschutzgesetz allows a transfer to a third country in that field where the European Commission has made an adequacy decision under Article 36(3) of Directive (EU) 2016/680. Where there is no such decision, Article 78 allows the transfer if a legally binding instrument provides appropriate safeguards or the controller concludes that they exist.
Article 79 allows a transfer without such safeguards where it is necessary for listed purposes, such as protecting the vital interests of a person. Article 84 adds a further transfer ground for activities outside the scope of both the GDPR and that Directive, for defense, crisis management and humanitarian purposes, beyond the cases the GDPR already allows.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .