Acts 2017
501
(vi) for the purpose of compelling legitimate interests
pursued by the controller or the processor which
are not overridden by the interests, rights and
freedoms of the data subjects involved and
where –
(A) the transfer is not repetitive and concerns
a limited number of data subjects; and
(B) the controller or processor has assessed
all the circumstances surrounding the data
transfer operation and has, based on such
assessment, provided to the Commissioner
proof of appropriate safeguards with
respect to the protection of the personal
data; or
(d)
the transfer is made from a register which, according
to law, is intended to provide information to the public
and which is open for consultation by the public or by
any person who can demonstrate a legitimate interest,
to the extent that the conditions laid down by law for
consultation are fulfilled in the particular case.
(2) A transfer pursuant to subsection (1)(d) shall not involve
the entirety of the personal data or entire categories of the personal data
contained in the register and, where the register is intended for consultation
by persons having a legitimate interest, the transfer shall be made only at
the request of those persons or in case they are to be the recipients.
(3) Subsection (1)(a) and (c)(i), (ii) and (vi) shall not apply to
activities carried out by a public authority in the exercise of its functions.
(4) The Commissioner may request a person who transfers data
to another country to demonstrate the effectiveness of the safeguards or the
existence of compelling legitimate interests and may, in order to protect
the rights and fundamental freedoms of data subjects, prohibit, suspend or
subject the transfer to such conditions as he may determine.