International transfer of personal data with a state, which does not have a sufficient level of data protection, in other cases than provided in the law, can be done with the authorization of the Commissioner. 