conditions of the execution of the criminal penalty, and the level of personal data protection in the third country or an international organisation to which personal data are onward transferred. The competent authority that carried out the original transfer may also subject the onward transfer to specific conditions. Such specific conditions can be described, for example, in handling codes. (46) The Commission may decide with effect for the entire Union that certain third countries, or a territory or one or more specified sectors within a third country, or an international organisation, offer an adequate level of data protection, thus providing legal certainty and uniformity throughout the Union as regards the third countries or international organisations which are considered to provide such a level of protection. In these cases, transfers of personal data to these countries may take place without needing to obtain any specific authorisation, except when another Member State from which the data were obtained has to give its authorisation to the transfer. (47) In line with the fundamental values on which the Union is founded, in particular the protection of human rights, the Commission should, in its assessment of the third country, or of a territory or of a specified sector within a third country, take into account how a given third country respects the rule of law, access to justice as well as international human rights norms and standards and its general and sectoral law, including legislation concerning public security, defence and national security as well as public order and criminal law. The adoption of an adequacy decision relating to a territory or a specified sector in a third country should take into account clear and objective criteria, such as specific processing activities and the scope of applicable legal standards and legislation in force in the third country. The third country should offer guarantees that ensure an adequate level of protection essentially equivalent to that guaranteed within the Union, in particular when data are processed in one or several specific sectors. In particular, the third country should ensure effective independent data protection supervision, provide for cooperation mechanisms with the European data protection authorities, and the data subjects should be provided with effective and enforceable rights and effective administrative and judicial redress. (47a) Apart from the international commitments the third country or international organisation has entered into, the Commission should also take account of obligations arising from the third country’s or international organisation’s participation in multilateral or regional systems in
(74) This Directive is without prejudice to the rules on combating the sexual abuse and sexual exploitation of children and child pornography as laid down in Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011. (75) In accordance with Article 6a of the Protocol on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, as annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, the United Kingdom and Ireland are not bound by the rules laid down in this Directive which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three of the Treaty on the Functioning of the European Union where the United Kingdom and Ireland are not bound by the rules governing the forms of judicial co-operation in criminal matters or police which require compliance with the provisions laid down on the basis of Article 16 of the Treaty on the Functioning of the European Union. (76) In accordance with Articles 2 and 2a of the Protocol on the position of Denmark, as annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not bound by the rules laid down in this Directive or subject to their application which relate to the processing of personal data by the Member States when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three of the Treaty on the Functioning of the European Union. Given that this Directive builds upon the Schengen acquis, under Title V of Part Three of the Treaty on the Functioning of the European Union, Denmark shall, in accordance with Article 4 of that Protocol, decide within six months after adoption of this Directive whether it will implement it in its national law. (77) As regards Iceland and Norway, this Directive constitutes a development of provisions of the Schengen acquis, as provided for by the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis. (78) As regards Switzerland, this Directive constitutes a development of provisions of the Schengen acquis, as provided for by the Agreement between the European Union, the
in a transparent manner, determine their respective responsibilities for compliance with the obligations under this Directive, in particular as regards the exercise of the rights of the data subject and their respective duties to provide the information referred to in Article 10a, by means of an arrangement between them unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which the controllers are subject. The arrangement shall designate the point of contact for data subjects. Member States may designate which of the joint controllers can act as a single point of contact for data subjects to exercise their rights. 1a. Irrespective of the terms of the arrangement referred to in paragraph 1, Member States may provide that the data subject may exercise his or her rights under the provisions adopted pursuant to this Directive in respect of and against each of the controllers. Article 21 Processor 1. Member States shall provide that where a processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a way that the processing will meet the requirements of this Directive and ensure the protection of the rights of the data subject. 1a. Member States shall provide that the processor shall not enlist another processor without the prior specific or general written authorisation of the controller. In the latter case, the processor shall always inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the opportunity to the controller to object to such changes. 2. Member States shall provide that the carrying out of processing by a processor shall be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller, setting out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, the obligations and rights of the controller and stipulating in particular that the processor shall: