order to assess the adequacy of the level of protection afforded by the country of
destination, the SDPA will take into consideration particularly the nature of the data,
the purpose and duration of the proposed processing operation or operations, the
country of origin and country of final destination, the rules of law, both general and
sectorial, in force in the third country in question, the content of the reports by the
Commission of the European Union, and the professional rules and security measures in force in those countries.
Art. 34 of the OLPPD indicates the circumstances under which prior authorization of the director of the SDPA is not required:
a) When the international transfer of personal data obtained by the application of
treaties or conventions to which Spain is a party.
b) When the transfer is made to deliver or seek international judicial assistance.
c) When the transfer is necessary for medical purposes of prevention or diagnosis,
the provision of medical care or treatment, or the management of health-care
services.
d) When it relates to cash transfers in accordance with their specific legislation.
e) When the person concerned has given unambiguous consent to the proposed
transfer.
f) When the transfer is necessary for the performance of a contract between the
individual concerned and the individual responsible for the file for the adoption
of pre-contractual measures taken at the request of the individual concerned.
g) When the transfer is necessary for the conclusion or performance of a contract
concluded in the interest of the individual concerned, the individual responsible
for the file and a third party.
h) Where the transfer is necessary or legally required to safeguard a public interest.
i) When the transfer is required for the establishment, exercise or defence of a right
in a legal process.
j) When the transfer is effected at the request of any person with a legitimate
interest from a public register and the request is consistent with the purpose of
the register.
k) When the destination of the transfer is a Member State of the EU or a State
declared to have an adequate level of protection by the Commission of the
European Communities.
According to the first Provisional Regulation of the OLPPD, the SDPA is
competent to protect the processing of personal data established in any international
convention in which Spain participates that confers said competence to a national
authority until a different authority is created for that purpose in the framework of the
convention.
394
F. M. Corvo López
destination, the SDPA will take into consideration particularly the nature of the data,
the purpose and duration of the proposed processing operation or operations, the
country of origin and country of final destination, the rules of law, both general and
sectorial, in force in the third country in question, the content of the reports by the
Commission of the European Union, and the professional rules and security measures in force in those countries.
Art. 34 of the OLPPD indicates the circumstances under which prior authorization of the director of the SDPA is not required:
a) When the international transfer of personal data obtained by the application of
treaties or conventions to which Spain is a party.
b) When the transfer is made to deliver or seek international judicial assistance.
c) When the transfer is necessary for medical purposes of prevention or diagnosis,
the provision of medical care or treatment, or the management of health-care
services.
d) When it relates to cash transfers in accordance with their specific legislation.
e) When the person concerned has given unambiguous consent to the proposed
transfer.
f) When the transfer is necessary for the performance of a contract between the
individual concerned and the individual responsible for the file for the adoption
of pre-contractual measures taken at the request of the individual concerned.
g) When the transfer is necessary for the conclusion or performance of a contract
concluded in the interest of the individual concerned, the individual responsible
for the file and a third party.
h) Where the transfer is necessary or legally required to safeguard a public interest.
i) When the transfer is required for the establishment, exercise or defence of a right
in a legal process.
j) When the transfer is effected at the request of any person with a legitimate
interest from a public register and the request is consistent with the purpose of
the register.
k) When the destination of the transfer is a Member State of the EU or a State
declared to have an adequate level of protection by the Commission of the
European Communities.
According to the first Provisional Regulation of the OLPPD, the SDPA is
competent to protect the processing of personal data established in any international
convention in which Spain participates that confers said competence to a national
authority until a different authority is created for that purpose in the framework of the
convention.
394
F. M. Corvo López