A/79/173 instruction. Its staff shall have experience and specialized knowledge regarding the processing of personal data. The authority shall be designated through a transparent public procedure, for a specified period of time. The individuals so designated may not be removed, except for serious reasons previously established in the respective regulations of each country. The authority must have sufficient investigative, supervisory, decision -making, promotion, sanctioning and other powers as may be necessary to guarantee the rights of data subjects and the proper processing of their information. It must also have sufficient economic, human and technological resources to perform its functions properly and in a timely manner. 22. Transborder data flows When the legislation of two or more countries concerned by a transborder data flow offers comparable safeguards for the proper processing of personal data, information should be able to circulate as freely as inside each of the territories concerned. If there are insufficient safeguards, limitations on such circulation may not be imposed unduly and only insofar as the protection of human rights demands. In order to determine whether a country has comparable safeguards, the following elements, inter alia, may be assessed: (a) The rule of law; respect for human rights and fundamental freedoms; and the relevant laws, both general and sectoral, on the processing of personal data; (b) The existence and effective functioning of one or more independent supervisory authorities responsible for ensuring and enforcing compliance with data protection rules, having adequate enforcement powers as well as powers to assist and advise data subjects and cooperate with data protection authorities; (c) International commitments undertaken by the third country or international organization concerned, or other obligations arising from legally binding agreements or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. The data controller and data processor may conduct international transfers of personal data in any of the following cases: • It has been proven that the country or part of its territory, the sector, the activity or international organization to which the personal data are to be exported has guarantees for ensuring the proper processing of the personal data that are comparable to those provided for in the national laws of the country from which the data are to be exported. • The exporter and recipient enter into a contract or any other legal instrument that provides sufficient guarantees and sets out the scope of the processing of personal data, the obligations and responsibilities assumed by the parties and the rights of the data subjects. The supervisory authority may validate contracts or legal instruments, as provided for under national law. • The exporter and the recipient adopt a binding self -regulation scheme or a certification mechanism approved by the data authority of the country from which the personal data are to be sent. 22/23 24-13146