§ 64 BlnDSG
General Conditions
(1)The transmission of personal data to bodies in third countries or to international organisations shall, where the other conditions for data transmissions are met, be permissible where 1. the body or international organisation is competent for the purposes referred to in Section 30(1) and (2), and 2. the European Commission has adopted an adequacy decision pursuant to Article 36(3) of Directive (EU) 2016/680.
(2)Despite the existence of an adequacy decision within the meaning of paragraph 1 no. 2, and taking into account the public interest in the data transmission, the transmission of personal data shall not take place where, in the individual case, an adequate treatment of the data that safeguards fundamental human rights is not sufficiently ensured at the recipient or where overriding legitimate interests of a data subject otherwise preclude it. In making its assessment, the controller shall primarily consider whether the recipient, in the individual case, guarantees an adequate level of protection for the transmitted data.
(3)Where personal data that have been transmitted from or made available by another Member State of the European Union are to be transmitted pursuant to paragraph 1, this transmission must first be authorised by the competent body of the other Member State. Transmissions without prior authorisation shall only be permissible where the transmission is necessary to prevent an immediate and serious threat to public safety of a state or to the essential interests of a Member State and the prior authorisation cannot be obtained in time. In the case of sentence 2, the body of the other Member State that would have been competent to grant authorisation shall be informed without undue delay of the transmission.
(4)The controller transmitting data pursuant to paragraph 1 shall, by appropriate measures, ensure that the recipient only further transmits the transmitted data to other third countries or other international organisations where the controller has authorised that transmission. In deciding whether to grant authorisation, the controller shall take into account all relevant factors, in particular the seriousness of the criminal offence, the purpose of the original transmission and the level of protection for personal data existing in the third country or international organisation to which the data are to be further transmitted. Authorisation may only be granted where a direct transmission to the other third country or the other international organisation would also be permissible. The competence to grant authorisation may also be regulated differently. zur Einzelansicht § 64