The transfer of personal data by Postfinance to a banking institution on U.S. territory must be based on a justification and the data subject must be adequately informed. Following our intervention, Postfinance has adjusted its practice and proposed measures that take our comments into account.