4. Where circulation over a network of the data referred to in 8 and 9 may
jeopardise the fundamental rights, freedoms and guarantees of their data
subjects, the CNPD may determine that transmission must be encoded.
Article 17
(Processing confidentiality)
Any person acting under the authority of the controller or the processor, including the
processor himself, who has access to personal data must not process them except on
instructions from the controller, unless he is required to do so by law.
Article 18
(Professional secrecy)
1.Controllers and persons who obtain knowledge of the personal data processed in
carrying out their functions shall be bound by professional secrecy, even after their
functions have ended.
2.Members of the CNPD shall be subject to the same obligation even after their
mandate has ended.
3.The provision in the previous numbers shall not exclude the duty to supply the
obligatory information according to the law, except when it is contained in filing
systems organised for statistical purposes.
4.Officers/agents or staff who serve as consultants for the CNPD or its members are
subjected to the same obligation of professional secrecy.
CHAPTER III
Transfer of personal data
SECTION I
Article 19
(Principles)
1. Without prejudice to the following Article, the transfer of personal data which
are undergoing processing or intended for processing may only take place
subject to compliance with the present Law and other legislation applicable to
issues of personal data protection and, undergoing processing for transfer to
another State, a country which has an adequate level of data protection.
2. The adequacy of the level of protection shall be assessed in light of all the
circumstances surrounding a data transfer or set of data transfers, in particular,
the nature of the data, the purpose and duration of the proposed processing, the
country of origin and country of final destination, the rules of law, both general
and sectoral, in force in the State in question, as well as the professional rules
and security measures which are complied with in that country.
3. It is for the CNPD to decide whether a foreign State ensures an adequate level of
protection.
Article 20