6. Only transfer personal data out of the EU if the conditions are met
The level of data protection may not meet the EU’s requirements when personal data is transferred out of the EU and European Economic Area (EEA). That is why there are certain conditions to be met if you intend to transfer data out of the EEA.
The hobby organiser must identify whether its activities involve the transfer of data to third countries (countries outside the EU or EEA). Personal data can be transferred via various systems and electronic services, for example.
In addition to the EU Member States, the EEA comprises Iceland, Liechtenstein and Norway. Personal data may be transferred to these countries on the same grounds as within Finland. Transferring personal data outside these countries can cause risks to the persons whose data is being transferred.
For the transfer of personal data to be permitted, both of the conditions below have to be met:
- the processing of personal data must be allowed in the circumstances in question; and
- there is a basis listed in the GDPR for the transfer. In addition, you need to assess on a case-by-case basis whether supplementary safeguards are needed to ensure an adequate level of data protection.
The use of each basis for transfer is subject to certain conditions. The hobby organiser must assess which of the bases for transfer is appropriate. If the conditions of none of the bases for transfer are met, the personal data may not be transferred.
Read more about international transfers of data on the Office of the Data Protection Ombudsman’s website: Transfers of personal data out of the European Economic Area.
