Transfer of personal data to third countries or international organisations
Can a controller engage a Chinese call centre for telemarketing activities, transmitting the list of its customers?
The controller can use a call centre operating in China (processor) provided that at least one of the following conditions applies:
1. customers have given their consent to the transfer of their data to China (third country), having been previously informed on data processing carried out by the Chinese processor
2. the commercial agreement includes the standard data protection clauses adopted by the European Commission for the transfer from a controller to a processor or ad-hoc contractual data protection clauses approved by the national supervisory authority
3. the Chinese call centre has adhered to the BCRs
4. the Chinese call centre has adhered to a code of conduct or to a certification mechanism.
Can companies which are not a group of undertakings adhere to the BCRs?
The GDPR provides that both a group of undertakings (e.g.: multinational) and a group of enterprises engaged in a joint economic activity can adhere to the BCRs.
What requirements shall the consent have to transfer personal data to third countries?
The consent shall be explicit and separate from the consent requested for other purposes of processing. Information to be provided ex arts. 13-14, GDPR shall include information on the safeguards of the transfer, including to whom personal data shall be transferred and for what purposes.