Cap. 484 Art. 21Professional secrecy, confidentiality and data protection. Cap. 586.

(1) Any data or information which is transferred between persons within the context of a securitisation transaction shall accordingly be transferable without any restriction or limitation, although such data or information shall retain its secret or a purpose that concerns a legitimate interest of the transferor and transferee of such data, unless it is shown that such interest is overridden by the interest to protect the fundamental rights and freedoms of the data subject and in particular the right to privacy; and

(b) any transfer of personal data to a third country that does not ensure an adequate level of protection within the meaning of article 10 of the Data Protection Act shall not require the authorisation of the Data Protection Commissioner, where the controller provides adequate safeguards, which may result particularly by means of appropriate contractual provisions, with respect to the protection of the privacy and fundamental rights and freedoms of individuals and with respect to their exercise.

(3) For the purposes of the foregoing paragraphs, data or information which is transferred between persons within the context of a securitisation transaction shall be deemed to include data or information transferred between the originator and the securitisation vehicle, or between one securitisation vehicle and another, or between the securitisation vehicle and any person delegated with administration duties and functions, or between the securitisation vehicle and a representative of the investors, or between the originator or securitisation vehicle and any credit rating agencies, or between the originator or the securitisation vehicle and any counter-party in a derivative contract, lender, liquidity provider or credit support provider.