The changes which entered into force on 1 December 2000: Adopted in Helsinki on 24 November 2000
In accordance with the decision of the Parliament, the lead paragraph and subparagraphs (6) and (7) of section 23 of the Personal Data Act of 22 April 1999 (523/1999) are amended, and a new section 22a and a new subparagraph (8) of section 23 are inserted into the Act, as follows:
Section 22a . Findings of the Commission
Personal data may be transferred out of the territory of the member states of the European Union or out of the European Economic Area in so far as the Commission of the European Communities has found, pursuant to Articles 3 and 25(6) of Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (in the following, the Data Protection Directive), that the country in question guarantees an adequate level of data protection.
Personal data shall not be transferred out of the territory of the member states of the European Union nor out of the European Economic Area in so far as the Commission has found, pursuant to Articles 3 and 25(4) of the Data Protection Directive, that the country in question does not guarantee an adequate level of data protection.
Section 23
Sections 22 and 22a do not prevent the transfer of data if:
…………………………………………………………………………..
6) the transfer is made from a file, the disclosure of data from which, either generally or for special reasons, has been specifically provided in an Act;
7) the controller, by means of contractual terms or otherwise, gives adequate guarantees of the protection of the privacy and the rights of individuals, and the Commission has not found, pursuant to Articles 3 and 26(3) of the Data Protection Directive, that the guarantees are inadequate; or
8) the transfer is made by using standard contractual clauses as adopted by the Commission in accordance with Article 26(4) of the Data Protection Directive.