purposes in the public interest, scientific or historical
research purposes or statistical purposes when there
is no recognisable risk of infringement of the rights
and fundamental freedoms of data subjects.
3.
In addition to the exceptions allowed for in paragraph 1 of this article, with reference to processing
activities for national security and defense purposes,
each Party may provide, by law and only to the extent
that it constitutes a necessary and proportionate
measure in a democratic society to fulfill such aim,
exceptions to Article 4 paragraph 3, Article 14 paragraphs 5 and 6 and Article 15, paragraph 2, litterae a,
b, c and d.
This is without prejudice to the requirement that
processing activities for national security and defense
purposes are subject to independent and effective
review and supervision under the domestic legislation
of the respective Party.
Article 12 – Sanctions and remedies
Each Party undertakes to establish appropriate judicial
and non-judicial sanctions and remedies for violations
of the provisions of this Convention.
Article 13 – Extended protection
None of the provisions of this chapter shall be interpreted as limiting or otherwise affecting the possibility
for a Party to grant data subjects a wider measure of
protection than that stipulated in this Convention.
Chapter III – Transborder flows of
personal data
Article 14 – Transborder flows of
personal data
1.
A Party shall not, for the sole purpose of the
protection of personal data, prohibit or subject to
special authorisation the transfer of such data to a
recipient who is subject to the jurisdiction of another
Party to the Convention. Such a Party may, however,
do so if there is a real and serious risk that the transfer
to another Party, or from that other Party to a nonParty, would lead to circumventing the provisions
of the Convention. A Party may also do so, if bound
by harmonised rules of protection shared by States
belonging to a regional international organisation.
2. When the recipient is subject to the jurisdiction
of a State or international organisation which is not
Party to this Convention, the transfer of personal data
may only take place where an appropriate level of
protection based on the provisions of this Convention
is secured.
3.
by:
An appropriate level of protection can be secured
Page 10 ► Convention 108+
a.
the law of that State or international organisation, including the applicable international treaties or
agreements; or
b.
ad hoc or approved standardised safeguards
provided by legally-binding and enforceable instruments adopted and implemented by the persons
involved in the transfer and further processing.
4.
Notwithstanding the provisions of the previous
paragraphs, each Party may provide that the transfer
of personal data may take place if:
a.
the data subject has given explicit, specific and
free consent, after being informed of risks arising in
the absence of appropriate safeguards; or
b.
the specific interests of the data subject require
it in the particular case; or
c.
prevailing legitimate interests, in particular
important public interests, are provided for by law
and such transfer constitutes a necessary and proportionate measure in a democratic society; or
d.
it constitutes a necessary and proportionate measure in a democratic society for freedom of expression.
5.
Each Party shall provide that the competent
supervisory authority within the meaning of Article
15 of this Convention is provided with all relevant
information concerning the transfers of data referred
to in paragraph 3.b and, upon request, paragraphs 4.b
and 4.c.
6.
Each Party shall also provide that the supervisory
authority is entitled to request that the person who
transfers data demonstrates the effectiveness of the
safeguards or the existence of prevailing legitimate
interests and that the supervisory authority may, in
order to protect the rights and fundamental freedoms
of data subjects, prohibit such transfers, suspend them
or subject them to condition.
Chapter IV – Supervisory authorities
Article 15 – Supervisory authorities
1.
Each Party shall provide for one or more authorities to be responsible for ensuring compliance with
the provisions of this Convention.
2.
To this end, such authorities:
a.
shall have powers of investigation and
intervention;
b.
shall perform the functions relating to transfers
of data provided for under Article 14, notably the
approval of standardised safeguards;
c.
shall have powers to issue decisions with respect
to violations of the provisions of this Convention and
may, in particular, impose administrative sanctions;