Before any actual transfer of personal data to that third country, the person responsible for the
processing must first obtain the permission of the Protection Body .
The transfer of personal data to third countries is subject to regular monitoring of the data protection
body in light of their purpose
Art 27 - The interconnection of files is authorized only if it permits to achieve legal and statutory
objectives with legitimate interest to those responsible for the processing.
It cannot lead to discrimination or reduction of rights, freedoms and guarantees for the persons
concerned or subject to inappropriate security measures and take into account the principle of
relevance of the data subject of the interconnection.
CHAPTER 5
Rights and exceptions to the rights of the person concerned
Art 28 - The person responsible for the processing shall provide the person whose data are being
processed, at the latest, during the collection and whatever the means and media used , with the
following information:
-
His/her identity and, if applicable, his/her authorized representative;
-
The purpose (s ) set for which the data are intended;
-
The categories of data concerned;
-
The recipient (s) to whom the data might be disclosed;
-
The possibility of refusing to appear on the file in question;
-
The existence of a right of access to data concerning the person and the right to rectify any
such data;
-
The shelf life of the data;
-
The possibility to transfer the data to third countries.
Art 29 - Any person whose personal data are being processed may request in the form of questions
and obtain from the person responsible for this processing;
-
Information permitting to know and challenge the processing;
-
Confirmation that personal data relating to him are or are not subject to this processing;
-
The communication of personal data concerning them and of any available information as to
the origin thereof;
-
Information about the purposes of the processing, the categories of personal data processed
and the recipients or categories of recipients to whom the data are disclosed.
If unable to access, the person concerned, right of access can be exercised by the data protection
body that has a power of investigation in the matter and may order the rectification, erasure or
blocking of data the processing of which does not comply with this Law.
The data protection body shall inform the person concerned of the results of its investigations.
The person responsible for the processing can be opposed to the grossly unfair requests from the
same person, including their number, repetitive or systematic character. In case of dispute, the