11 Transfer of personal data to a third country Prohibition of transfer of personal data to a third country Section 33 It is prohibited to transfer to a third country personal data that is undergoing processing unless the third country has an adequate level of protection for personal data. The provision also applies to transfer of personal data for processing in a third country. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding the transfer. Particular consideration shall be given to the nature of the data, the purpose of the processing, the duration of the processing, the country of origin, the country of final destination and the rules that exist for the processing in the third country. Exemptions from the prohibition of transfer of personal data to a third country Section 34 Notwithstanding the prohibition in Section 33, it is permitted to transfer personal data to a third country if the registered person has given his/her consent to the transfer or if the transfer is necessary for a) the performance of a contract between the registered person and the controller of personal data or the implementation of precontractual measures taken in response to the request of the registered, b) the conclusion or performance of a contract between the controller of personal data and a third party which is in the interest of the registered person, c) the establishment, exercise or defence of legal claims, or d) the protection of vital interests of the registered person. It is also permitted to transfer personal data for use only in a state that has acceded to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. Section 35 The Government may issue regulations about exemptions from the prohibition in Section 33 of the transfer of personal data to certain states. The Government may also as regards automated processing of personal data issue regulations about transfer of personal data to a third country being permitted, provided the transfer is regulated by a contract that provides adequate safeguards to protect the rights of the registered person. Furthermore, the Government or the authority appointed by the Government issue regulations about exemptions from the prohibition in Section 33, if this is necessary having regard to an important public interest or if there are adequate safeguards to protect the rights of the registered person. The Government may, subject to the preconditions mentioned in the second paragraph, decide in individual cases on an exemption from the prohibition in Section 33. The Government may delegate power to the supervisory authority to make such decisions.