4. Where circulation over a network of the data referred to in 8 and 9 may jeopardise the fundamental rights, freedoms and guarantees of their data subjects, the CNPD may determine that transmission must be encoded. Article 17 (Processing confidentiality) Any person acting under the authority of the controller or the processor, including the processor himself, who has access to personal data must not process them except on instructions from the controller, unless he is required to do so by law. Article 18 (Professional secrecy) 1.Controllers and persons who obtain knowledge of the personal data processed in carrying out their functions shall be bound by professional secrecy, even after their functions have ended. 2.Members of the CNPD shall be subject to the same obligation even after their mandate has ended. 3.The provision in the previous numbers shall not exclude the duty to supply the obligatory information according to the law, except when it is contained in filing systems organised for statistical purposes. 4.Officers/agents or staff who serve as consultants for the CNPD or its members are subjected to the same obligation of professional secrecy. CHAPTER III Transfer of personal data SECTION I Article 19 (Principles) 1. Without prejudice to the following Article, the transfer of personal data which are undergoing processing or intended for processing may only take place subject to compliance with the present Law and other legislation applicable to issues of personal data protection and, undergoing processing for transfer to another State, a country which has an adequate level of data protection. 2. The adequacy of the level of protection shall be assessed in light of all the circumstances surrounding a data transfer or set of data transfers, in particular, the nature of the data, the purpose and duration of the proposed processing, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the State in question, as well as the professional rules and security measures which are complied with in that country. 3. It is for the CNPD to decide whether a foreign State ensures an adequate level of protection. Article 20