3 – The provision in the previous numbers shall not exclude the duty to supply the obligatory information according to the law, except when it is contained in filing systems organised for statistical purposes. 4 – Officers, agents or staff who act as consultants for the CNPD or its members shall be subject to the same obligation of professional secrecy. Without prejudice to the tax or customs decisions of the Community, personal data may move freely between Member States of the European Union. 1 - Without prejudice to the following Article, the transfer to a State which is not a member of the European Union of personal data which are undergoing processing or intended for processing may only take place subject to compliance with this Act and provided the State to which they are transferred ensures an adequate level of protection. 2 – The adequacy of the level of protection of a State which is not a member of the European Union shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the State in question and the professional rules and security measures which are complied with in that country. 3 – It is for the CNPD to decide whether a State which is not a member of the European Union ensures an adequate level of protection. 4 – By means of the Ministry of Foreign Affairs the CNPD shall inform the European Commission of cases where it considers that a State does not ensure an adequate level of protection. 5 – The transfer of personal data identical to those the European Commission has considered do not enjoy adequate protection in the State to which they are to be sent shall be prohibited. 1 - A transfer of personal data to a State which does not ensure an adequate level of protection within the meaning of Article 19 (2) may be allowed by the CNPD if the data subject has given his consent unambiguously to the proposed transfer or if that transfer: (a) is necessary for the performance of a contract between the data subject and the controller or the implementation of precontractual measures taken in response to the data subject’s request; (b) is necessary for the performance or conclusion of a contract concluded or to be concluded in the interests of the data subject between the controller and a third party; or (c) is necessary or legally required on important public interest grounds, or for the establishment, exercise of defence of legal claims; or 11/20