Deviations for specific situations
In the absence of an adequacy decision pursuant to Article 45(3) or appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or series of transfers of personal data to a third country or an international organization may take place only if one of the following conditions is met:
the data subject has expressly consented to the proposed transfer, having been informed of the risks that such transfers may entail for him in the absence of an adequacy decision and appropriate safeguards;
the transfer is necessary for the performance of a contract between the data subject and the controller or for the implementation of pre-contractual measures taken at the request of the data subject;
the transfer is necessary for the conclusion or performance of a contract concluded in the data subject's interest between the controller and another natural or legal person;
the transfer is necessary for important reasons of public interest;
the transfer is necessary for the establishment, exercise or vindication of legal claims;
the transfer is necessary for the protection of the vital interests of the data subject or of other persons, if the data subject is physically or legally incapable of giving his consent;
the transfer has been made from a register which under Union or Member State law is intended to provide information to the public and which may be consulted by any person or by any person who can invoke a legitimate interest, but only to the extent that, in the case in question, the conditions for consultation laid down in Union or Member State law are fulfilled.
Where a transfer could not be based on a provision of Articles 45 or 46, including those relating to binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph apply, the transfer is not repetitive, concerns a limited number of data subjects is necessary for overriding legitimate interests of the controller which are not subordinate to the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has provided appropriate safeguards for the protection of personal data based on that assessment. The controller shall inform the supervisory authority of the transfer. In addition to the information referred to in Articles 13 and 14, the controller shall inform the data subject about the transfer and the overriding legitimate interests pursued by it.
A transfer pursuant to point (g) of the first subparagraph of paragraph 1 may not relate to all personal data or entire categories of personal data contained in the register. Where a register is intended to be consulted by persons with a legitimate interest, the transfer may be made only at the request of those persons or if the data are intended for them.
Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph of paragraph 1 shall not apply to activities carried out by public authorities in the exercise of their public powers.
The public interest referred to in point (d) of the first subparagraph of paragraph 1 must be recognized by a provision of Union or national law applicable to the controller.
In the absence of an adequacy decision, provisions of Union or Member State law or provisions based on important grounds of public interest may expressly set limits on the transfer of specific categories of personal data to a third country or an international organization. Member States shall notify such provisions to the Commission.
The controller or processor shall document the assessment and appropriate safeguards referred to in the second subparagraph of paragraph 1 of this Article in the register referred to in Article 30.
