It is not permitted to transfer personal data to a State that is not a Member of the European Union, unless:
- the data subject has expressly consented to their transfer;
- the data is transferred to a country recognised by the European Commission as offering an adequate level of protection;
- contractual clauses approved by the European Commission are signed between the parties;
- Binding Contractual Clauses are adopted;
- in the case of transfers to the United States, the recipient has adhered to the Privacy Shield;
- the transfer is necessary subject to one of the following conditions for:
- the performance of a contract between the data subject and the controller;
- the conclusion or performance of a contract concluded in the interest of the data subject;
- important reasons of public interest;
- the recognition, exercise or defense of rights in court;
- the vital interests of the person;
- the consultation, in accordance with legal conditions, of a public register that, according to legislative and regulatory provisions, is intended for public information and is open for public consultation or by any person demonstrating a legitimate interest; the security or sovereignty of the state.
Article 112 of law “Informatique et Libertés” indicates that when a transfer is made for the purpose of safeguarding the data subject’s legitimate interests, the data controller shall keep track of the date and time of the transfer, the information on the receiving competent authority, the justification of the transfer and personal data transferred. He makes this information available to the CNIL at his request.
Likewise, the DPA has to authorise Binding Corporate Rules (BCRs), but overall it supports its usage. It is possible to obtain authorisation from one supervisory authority which covers international transfers from anywhere in the EU. It also has to authorise the use of ‘minor transfer exemption’.
The European Data Protection Board has issued Guidelines on derogations applicable to international transfers.
Please also visit: https://gdpr-info.eu/chapter-5/
And : Article 112-113 & 115 https://www.legifrance.gouv.fr/affichTexteArticle.do?idArticle=LEGIARTI000037817702&cidTexte=JORFTEXT000000886460&dateTexte=20190601