§ 66 LDSG RP
General Conditions
(1)The transfer of personal data to bodies in third countries or to international organisations shall, where the other conditions applicable to data transfers are met, be lawful where 1. the transfer is necessary for the purposes referred to in Section 26(1), 2. the body or organisation is competent for the purposes referred to in Section 26(1), and 3. the European Commission has adopted an adequacy decision pursuant to Article 36(1) of Directive (EU) 2016/680 or, where no such decision exists, appropriate safeguards within the meaning of Section 67 have been provided or exist, or, where neither such a decision nor appropriate safeguards exist, derogations for specific situations pursuant to Section 68 are applicable.
(2)The transfer of personal data shall be refrained from notwithstanding the existence of an adequacy decision within the meaning of paragraph 1 No. 3 and the public interest in the data transfer to be taken into account, where in an individual case an adequate and humane handling of the data respecting fundamental human rights by the recipient is not sufficiently ensured or where overriding legitimate interests of a data subject preclude it. In his or her assessment, the controller shall take significant account of whether the recipient in the individual case guarantees adequate protection of the transferred data.
(3)Where personal data which have been transmitted or made available from another Member State of the European Union are to be transferred pursuant to paragraph 1, this transfer must first be authorised by the competent authority of the other Member State. Transfers without prior authorisation shall only be permissible where the transfer is necessary to avert an imminent and serious threat to the public security of a state or to the essential interests of a Member State, and the prior authorisation cannot be obtained in time. In the case of sentence 2, the authority of the other Member State that would have been competent to grant the authorisation shall be informed without delay of the transfer.
(4)The controller transferring data pursuant to paragraph 1 shall ensure by appropriate measures that the recipient only onward-transfers the transferred data to other third countries or other international organisations where the controller has approved such transfer. In deciding whether to grant approval, the controller shall take into account all relevant factors, in particular the severity of the criminal offence, the purpose of the original transfer and the level of protection of personal data in the third country or international organisation to which the data are to be onward-transferred. Approval shall only be granted where a direct transfer to the other third country or the other international organisation would also be permissible. The competence for granting approval may also be regulated differently. zur Einzelansicht § 66