The Transfer of Personal Data and its Protection

Nowadays, for the market to continue to evolve, the transfer of personal data from one company to another is essential. However, if we talk about evolving or growing within the market, this transfer must be carried out in compliance with the regulations that regulate it, because against it, what an entrepreneur can find is a high sanction for breaches and violations of fundamental rights. In addition, we must take into account the progress that digitalization has undergone in recent years, since we are increasingly connected to technology. In this regard and as legislation and practice progress, these concepts will undoubtedly continue to evolve and change until technology and regulations come together. In the data protection regulations currently in force in Spain, there is a transfer of data when the third party assignee can apply the processing of data for their own purposes, being able to decide the basis of legitimation and the purpose of the processing of the same. However, this transfer of personal data must be contemplated in a contract signed between the parties (transferor and transferee) and correctly informed to the interested parties. It is also necessary to take into account that the interested party must consent to the transfer and the person responsible for the processing of personal data must have all the consents of the people whose data will be transferred to third parties, both for the collection of their personal data and for their processing and transfer, otherwise incurring a serious infraction. However, it is necessary distinguish a transfer from what is not considered a transfer of personal data. Consequently, access by a third party to customer data that another controller has in their own file is not considered a transfer of data, when such access is necessary for them to provide you with a service, so this type of consent on the part of the interested party will be different from that required in the transfer of personal data. On the other hand, there are also international transfers of personal data, it is a processing of data that involves a transmission of the same outside the territory of the European Economic Area (EEA), either constitutes a transfer or communication of data. At Tourism & Law, we encourage companies in the tourism sector that wish to grow in the market, to comply with legislation on data protection, and for this reason, our team has lawyers specialized in this area who will be at your disposal to advise you on the communication or transfer of personal data, a matter that is so necessary in our sector.

Rosario Saldarriga (T&L Attorney)