Transfer of data abroad

Research is an international activity, and a need to transfer personal data out of Finland may arise during a project. There is legislation to ensure that the level of data protection does not deteriorate even if a research project requires the transfer of personal data to third countries. These transfer requirements also apply to pseudonymised data.

Data protection regulations seek to promote the mobility of personal data within the European Union and European Economic Area. The same rules apply to the transfer of personal data to an EEA Member State as to transfers within Finland. Due to the national margin of manoeuvre permitted by the GDPR, however, different conditions for the processing of personal data, safeguards and restrictions on the use of personal data for research activities can be specified in the national enactments of EU and EEA Member States.

Transferring personal data out of the European Economic Area requires the processing to be lawful in Finland, and the transfer must be carried out according to the data transfer principles defined in the GDPR. The controller must make sure that there is a basis for transfer if a research project transfers data out of the European Union or European Economic Area.

In a research project, the need may arise to transfer personal data out of Finland to EU or EEA Member States, or to third countries outside the EU and EEA. Such transfers can be necessary due to cooperation with entities based in other countries, the availability of necessary analysis methods, or the processing of research data on technical platforms located abroad.

Personal data can be transferred to third countries if the European Commission has decided that the third country in question is capable of ensuring a sufficient level of data protection. Transfers to such third countries do not require a specific permission.

Personal data can also be transferred to third countries if the controller implements the appropriate safeguards. Such safeguards can consist of standard data protection clauses, for example.

The transfer of personal data to third countries is also possible on special grounds. Special grounds for the transfer of personal data can only be invoked in certain exceptional circumstances when other grounds for transfer are not available.