10. Replacement of section 26 of the principal enactment

Official English translation. Where it differs from the Sinhala or Tamil text, the Act itself says which text prevails.

Section 26 of the principal enactment is hereby repealed and the following section is substituted therefor:-

26. (1) A controller or processor may engage in cross-border data ﬂ ows, only where such controller or processor, ensures compliance with the provisions of Part I,

Part II and sections 20, 21, 22, 23, 24 and 25, as the case may be.

(2)

For the purpose of ensuring compliance under subsection (1), a controller or processor shall adopt such instruments as may be speciﬁ ed by a directive issued by the

Authority under paragraph (c) of section 33, to ensure binding and enforceable commitments of the recipient in the third country to ensure appropriate safeguards to the rights of the data subjects and remedies available under this Act.

(3)

Notwithstanding the provisions of subsection (1), a controller or processor may engage in cross-border data ﬂ ows, if-

(a)

the data subject has explicitly consented to the proposed cross-border data ﬂ ow, after having been informed of the possible risks of such processing for the data subject;

(b)

the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of any pre contractual measures taken by the controller at the request of the data subject;

“Cross-border data flow

(c)

the transfer is necessary for the establishment, exercise or defence of legal claims relating to the data subject;

(d)

the transfer is necessary for reasons of public interest as deﬁ ned in item (g) of Schedule I to this Act;

(e)

the transfer is necessary to respond to an emergency that threatens the life, health or safety of the data subject or where his legal guardian is physically or legally incapable of giving consent;

(f)

the transfer constitutes only a transit of personal data through Sri Lanka;

(g)

such processing is permitted under any other conditions as may be prescribed under this Act.

(4)

A controller or processor who is a public authority shall not engage in cross-border data flows in respect of the categories of personal data as may be prescribed under subsection (5).

(5)

The Minister may, prescribe the categories of personal data for the purposes of subsection (4), upon a request made by the

Authority or a controller or processor who is a public authority in consultation with the relevant statutory or regulatory body.”.

Read on from s 11