In derogation from Article 16 paragraphs 1 and 2, personal data may be disclosed abroad in the following cases:
The data subject has explicitly consented to disclosure.
Disclosure is directly connected with the conclusion or performance of a contract:
between the controller and the data subject; or
between the controller and its contractual partner in the interests the data subject.
Disclosure is necessary in order to:
safeguard an overriding public interest; or
establish, exercise or enforce legal rights before a court or another competent foreign authority.
Disclosure is necessary to protect the life or the physical integrity of the data subject or a third party, and it is not possible to obtain the consent of the data subject within a reasonable time.
The data subject has made the data generally accessible and has not explicitly prohibited processing.
The data originate from a statutory register that is public or accessible to persons with a legitimate interest, provided the statutory requirements for access are met in the case concerned.
The controller or the processor shall inform the FDPIC on request about the disclosure of personal data under paragraph 1 letters b number 2, c and d.