the free movement of such data meet the requirement as regards an adequate level of protection. In assessing the adequacy of the level of protection, emphasis shall be placed, inter alia on the nature of the data, the purpose and duration of the proposed processing and the rules of law and the professional rules and security measures which apply in the country in question. Importance shall also be attached to whether the country has acceded to the Council of Europe’s Convention No. 108 of 28 January 1981 on the protection of individuals with regard to the automatic processing of personal data. Section 30 Exceptions Personal data may also be transferred to countries which do not ensure an adequate level of protection if a) the data subject has consented to the transfer, b) there is an obligation to transfer the data pursuant to an international agreement or as a result of membership of an international organization, c) the transfer is necessary for the performance of a contract with the data subject, or for the performance of tasks at the request of the data subject prior to entering into such a contract, d) the transfer is necessary for the conclusion or performance of a contract with a third party in the interest of the data subject, e) the transfer is necessary in order to protect the vital interests of the data subject, f) the transfer is necessary in order to establish, exercise or defend a legal claim, g) the transfer is necessary or legally required in order to protect an important public interest, or h) there is statutory authority for demanding data from a public register. The Data Inspectorate may allow transfer even if the conditions of the first paragraph are not fulfilled if the controller provides adequate safeguards with respect to the protection of the rights of the data subject. The Data Inspectorate may stipulate conditions for the transfer. The King may prescribe regulations regarding the transfer of personal data to another country, including regarding stopping or limiting transfers to specified countries which do not satisfy the requirements set out in section 29. Chapter VI Obligation to give notification and to obtain a licence Section 31 Obligation to give notification The controller shall notify the Data Inspectorate before a) processing personal data by automatic means b) establishing a manual personal data filing system which contains sensitive personal data. Notification shall be given not later than 30 days prior to commencement of processing. The Data Inspectorate shall give the controller a receipt of notification. New notification must be given prior to processing that exceeds the limits for processing provided for in section 32. Even if no changes have taken place, new notification shall be given three years after the previous notification was given. The King may prescribe regulations to the effect that certain methods of processing or controllers are exempted from the obligation to give notification, subject to a simplified obligation to give notification or subject to an obligation to obtain a licence. For processing that is exempt from the obligation to give notification,