7 Chapter 5 — Transfer of personal data to outside the European Union Section 22 — General prerequisites (1) Personal data may be transferred to outside the European Union or the European Economic Area only if the country in question guarantees an adequate level of data protection. (2) The adequacy of the level of data protection shall be evaluated in the light of the nature of the data, the purpose and duration of the intended processing, the country of origin and the country of final destination, as well as the general and sectoral legal provisions, codes of conduct and security measures applied in that country. Section 22a – Findings of the Commission (986/2000) (1) Personal data may be transferred out of the territory of the member states of the European Union or out of the European Economic Area in so far as the Commission of the European Communities has found, pursuant to Articles 3 and 25(6) of Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (in the following, the Data Protection Directive), that the country in question guarantees an adequate level of data protection. (2) Personal data shall not be transferred out of the territory of the member states of the European Union nor out of the European Economic Area in so far as the Commission has found, pursuant to Articles 3 and 25(4) of the Data Protection Directive, that the country in question does not guarantee an adequate level of data protection. Section 23 — Grounds for derogation Sections 22 and 22a do not prevent the transfer of data if: (986/2000): (1) the data subject has unambiguously consented to the transfer; (2) the data subject has given an assignment for the transfer, or this is necessary in order to perform a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract; (3) the transfer is necessary in order to make or perform an agreement between the controller and a third party and in the interest of the data subject; (4) the transfer is necessary in order to protect the vital interests of the data subject; (5) the transfer is necessary or called for by law for securing an important public interest or for purposes of drafting or filing a lawsuit or for responding to or deciding such a lawsuit; (6) the transfer is made from a file, the disclosure of data from which, either generally of for special reasons, has been specifically provided in an Act; (986/2000) (7) the controller, by means of contractual terms or otherwise, gives adequate guarantees of the protection of the privacy and the rights of individuals, and the Commission has not found, pursuant to Articles 3 and 26(3) of the Data Protection Directive, that the guarantees are inadequate; or (986/2000) (8) the transfer is made by using standard contractual clauses as adopted by the Commission in accordance with Article 26(4) of the Data Protection Directive. (986/2000) Chapter 6 — The data subject’s rights Section 24 — Information on the processing of data (1) When collecting personal data, the controller shall see to that the data subject can have information on the controller and, where necessary, the representative of the controller, on the purpose of the processing of the personal data, on the regular destinations of disclosed data, as well as on how to proceed in order to make use of the rights of the data subject in respect to the processing operation in question. This information shall be provided at the time of collection and recording of the data or, if the data are obtained from elsewhere than the data subject and intended for disclosure, at the latest at the time of first disclosure of the data.