Law No. 2014-038, cross-border transfer of personal data

Article 20 bars a controller from transferring personal data to a foreign State unless that State's legislation assures a level of protection for people similar to what this law assures, a level assessed against every circumstance of the transfer, including the data's nature, the purpose and duration of the processing, the countries of origin and final destination, and the third country's general or sector rules of law, professional rules, and security measures.

Absent a similar level of protection, the CMIL may still authorize the transfer where the controller offers sufficient guarantees for privacy and fundamental rights and freedoms, which may rest on appropriate contractual clauses or binding internal rules.

By way of exception to those paragraphs, a transfer to a country that does not assure a similar level of protection may still go ahead where the data subject has unambiguously consented to the transfer after being informed there is no similar level of protection, where the transfer is necessary to perform or negotiate a contract with the data subject or a contract in the data subject's interest with a third party, where it is necessary or legally required to safeguard an important public interest or to establish, exercise, or defend a legal right, where it safeguards the data subject's vital interest, or where it comes from a public register open to public consultation under legislative or regulatory provisions and the legal conditions for consulting it are met.

Article 20 also bars a recipient from transferring the data onward to a foreign country again without the agreement of the original controller and of the CMIL.