Commentaries: Art. 9

The data protection clauses in an agreement under Article 16 paragraph 2 letter b FADP and the specific guarantees under Article 16 paragraph 2 letter c FADP must include at least the following points:
1. the requirement to apply the principles of legality, good faith, proportionality, transparency, purpose limitation and accuracy;
2. the categories of personal data disclosed and of data subjects;
3. the manner and purpose of the disclosure of personal data;
4. if applicable, the names of the countries or international organisations, in which personal data is to be disclosed and the requirements for disclosure;
5. the requirements for safeguarding, deleting and destroying personal data;
6. the recipients or the categories of recipients;
7. the measures to guarantee data security;
8. the requirement to report breaches of data security;
9. if the recipients are controllers: the requirement to inform the data subjects about the processing;
10. the rights of data subjects, and in particular:
1. the right of access and the right to the data portability, 2. the right to object to the disclosure of personal data, 3. the right to the correction, deletion or destruction of their data, 4. the right to request an independent authority for judicial protection.
The controller and, in the case of data protection clauses in an agreement, the processor must take appropriate measures to ensure that the recipient complies with these clauses or the specific guarantees.
If the FDPIC is informed about the data protection clauses in an agreement or the specific guarantees, the duty to provide information is deemed fulfilled for all further disclosures that:
1. are made in accordance with the same data protection clauses or guarantees, provided the categories of recipients, purpose of processing and data categories essentially remain unchanged; or
2. take place within the same legal entity or company or between company that belong to the same group of companies.