In view of international trade and cooperation, it is essential these days to be able to also transmit data to third countries. Examining the legitimacy of such a transfer is done in two stages.
First, the data transfer itself must be legal. Any processing of personal data is prohibited but subjected to the possibility of authorization. In addition to consent, Art. 6 of the General Data Protection Regulation (GDPR) sets forth further authorization reasons, such as fulfilling a contract or protecting vital interests. For special personal data which requires a higher level of protection, the Art. 9 of the GDPR provides separate legal requirements.
If the intended data transfer meets the general requirements, one must check in a second step whether transfer to the third country is permitted. One must differentiate between secure and unsecure third countries. Secure third countries are those for which the European Commission has confirmed a suitable level of data protection on the basis of an adequacy decision. In those countries, national laws provide a level of protection for personal data which is comparable to those of EU law. The third countries which ensure an adequate level of protection are: Andorra, Argentina, Canada (only commercial organizations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay , Japan, the United Kingdom and South Korea. Data transfer to these countries is expressly permitted.
With the judgment “Schrems II” of July 16, 2020 (in case C-311/18), the ECJ declared the Commission’s Implementing Decision (EU) 2016/1250 of July 12, 2016 in accordance with Directive 95/46 / EC of the European Parliament and the Council on the adequacy of the EU-US data protection shield (Privacy Shield) invalid with immediate effect. Data transmissions to the USA cannot therefore be based on the Privacy Shield. Data transfers to the USA require other guarantees, according to Art. 44 et seq. GDPR, to create an appropriate level of data protection.
If there is no adequacy decision for a country, this does not necessarily foreclose any data transfer to this country. Rather, the controller must ensure in another way that the personal data will be sufficiently protected by the recipient. This can be assured using standard contractual clauses, for data transfers within a Group through so-called “binding corporate rules,” through the commitment to comply with codes of conduct, which have been declared by the European Commission as being generally applicable, or by certification of the data processing procedure.
Furthermore, there are several exceptions, which legitimize data transfer to a third country, even if the protection of personal data cannot be sufficiently assured. Most frequently, the consent of the data subject is relevant here. At the same time, one must particularly note the requirements for such a consent to be given freely. Further exceptions, such as transmitting to fulfil contracts, important reasons of public interest and the assertion of legal rights are usually less relevant in practice.
Suitable GDPR articles
Art. 40 GDPR Codes of conductArt. 42 GDPR CertificationArt. 44 GDPR General principle for transfersArt. 45 GDPR Transfers on the basis of an adequacy decisionArt. 46 GDPR Transfers subject to appropriate safeguardsArt. 47 GDPR Binding corporate rulesArt. 48 GDPR Transfers or disclosures not authorised by Union lawArt. 49 GDPR Derogations for specific situationsArt. 63 GDPR Consistency mechanism
Suitable Recitals
(101) General Principles for International Data Transfers(102) International Agreements for an Appropriate Level of Data Protection(103) Appropriate Level of Data Protection Based on an Adequacy Decision(104) Criteria for an Adequacy Decision(105) Consideration of International Agreements for an Adequacy Decision(106) Monitoring and Periodic Review of the Level of Data Protection(107) Amendment, Revocation and Suspension of Adequacy Decisions(108) Appropriate Safeguards(109) Standard Data Protection Clauses(110) Binding Corporate Rules(111) Exceptions for Certain Cases of International Transfers(112) Data Transfers due to Important Reasons of Public Interest(113) Transfers Qualified as Not Repetitive and that Only Concern a Limited Number of Data Subjects(114) Safeguarding of Enforceability of Rights and Obligations in the Absence of an Adequacy Decision(115) Rules in Third Countries Contrary to the Regulation
External Links
Authorities
- Data Protection Authority UK ► International transfers (Link)
- Data Protection Authority Ireland ► Cross-border processing and the one stop shop (Link)
- Data Protection Authority Isle of Man ► Transfers to third countries (Link)
- Article 29 Data Protection Working Party ► WP244 – Guidelines on the Lead Supervisory Authority (Link)
- Article 29 Data Protection Working Party ► WP245 – EU-US Privacy Shield F.A.Q. for European Businesses (Link)
- European Commission ► Data transfers outside the EU (Link)
- European Commission ► Withdrawal of the United Kingdom from the Union and EU – Rules in the field of data protection (Link)
- ► Handbook on European data protection law – Personal data transfers to third countries/non-parties or to international organisations, page 253 (Link)
- European Data Protection Board ► FAQs on the judgment of the CJEU in Case C-311/18 (Link)
Expert contribution
Key IssuesTable of contents
Report error
