The type of entities to which such data may be transferred

In accordance with GDPR SMA can make transfers of personal data to a third country authority in those cases, where the European Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation ensures an adequate level of protection (adequacy decision – Article 45 of GDPR).

SMA may also transfer personal data to those third countries (and consequently to the authorities of third countries) for which the Information Commissioner in the Republic of Slovenia determines that they have fully or partially ensured an adequate level of personal data protection. The list is available here.

With regard to Article 46(3) (b) of GDPR SMA signed the Administrative Arrangement for the transfer of personal data (AA).

SMA can also make transfers of personal data to a third country authority, if the transfer is necessary for important reasons of public interest (Article 49(1)(d) of GDPR).

The transfer of personal data according to the AA is limited to transfers of personal data between SMA and third country authority that signed the AA (non-EEA Authority), in their capacity as public authorities, regulators and/or supervisors of securities and/or derivatives markets.

The transfer of confidential information, that include personal data, is also regulated in Article 469c of Financial Instruments Market Act.