The FSMA will not itself process your Data outside the European Economic Area (EEA).
It is possible that service providers whose services the FSMA uses may process your data outside the EEA (for example in the United States). Where this is the case, the FSMA ensures that the service provider enters into a contract with the FSMA and that the level of protection is guaranteed, for example by way of a decision of the European Commission determining that a third country provides an adequate level of protection (Article 45 GDPR), by way of standard data protection clauses drawn up by the European Commission and entered into by parties that process data outside the EEA (Article 46 GDPR) or by way of another legal instrument that provides appropriate guarantees.
The FSMA may, as part of its public-interest tasks and of the exercise of public authority, and within the limits provided for by Articles 74 and 75 of the Law of 2 August 2002, exchange personal data with a financial supervisory authority of a country outside the EEA (hereafter ‘third country’) for purposes of international cooperation. Where this is the case, the FSMA ensures that:
- the third country ensures an adequate level of protection (adequacy decision of the European Commission - Article 45 of the GDPR); or
- appropriate safeguards are in place (Article 46 of the GDPR), in particular where the financial supervisory authority of a non-EEA country has undertaken to provide safeguards that are laid down in an administrative arrangement such as the Administrative arrangement for the transfer of personal data between EEA and non-EEA authorities; or
- a derogation, and in particular a derogation for transfers that are necessary for important reasons of public interest (Article 49 of the GDPR).
The FSMA will only transfer personal data that are adequate, relevant and limited to what is necessary for the purposes for which they are transferred.
If you have any questions about this subject, please feel free to send a request to the FSMA for the attention of the Data Protection Officer. You will find the contact details of the DPO in the answer to the question below on ‘How can you contact us?’of this Privacy Policy