29
have critical implications for non-EC countries, including Botswana.
The first principle of Article 25 states:
“The Member State shall provide that the transfer to a third
country of personal data which are undergoing processing or are
intended for processing after transfer may take place only if,
without prejudice to compliance with the national provisions
adopted pursuant to the other provisions of this Directive, the
third country in question ensures an adequate level of
protection”.
4.3.8
The second principle states:
“The adequacy of the level of protection afforded by a third country
shall be assessed in the light of all the circumstances surround a data
transfer operation or set of data transfer operations; particular
consideration shall be given to the nature of the data, the purpose and
duration of the proposed processing operation or operations, the
country of origin and country of final destination, the rules of law,
both general and sectoral, in force in the third country in question and
the professional rules and security measures that are complied with in
that country”.
4.3.9
To date, the Commission has determined that personal data can flow
from the EU Member Countries (and Norway, Liechtenstein and
Iceland) to the following recognised “third” countries: Switzerland;
Canada; Argentina; Guernsey, Isle of Man; and in the United States,
companies following the U.S. Safe Harbor Rules and Air Passenger
Name Records to the U.S. Bureau of Customs and Border Protection.
4.3.10 The EC Directive, coupled with the Principles outlined in the OECD
Guidelines have informed most of the legislation and practice in privacy
protection in developed and developing countries. The legislative and
institutional form of privacy protection may vary significantly, however.
The primary differences are not in the underlying principles but in the
degree to which industry takes responsibility for implementation and the
degree to which coverage applies across commercial and government
sectors. The consideration of these factors and the institutional and
legislative design decisions will be very important to Botswana and to
the successful implementation of a privacy regime that will be both
effective and meet international standards while not being unduly
burdensome in terms of resources, including expertise.16
16
A specific role identified for the Hong Kong Privacy Commissioner is to ensure “all other
jurisdictions with data protection laws are aware of the robustness of the protection of the
privacy of the individual with respect to personal data so as to prevent interference with the free
flow of personal data to Hong Kong.” www.pco.org.hk/english/about/role.html