international commitments, a level of protection of fundamental rights and freedoms
that is “essentially equivalent to that guaranteed within the European Union”.
162
After having assessed the adequacy of the level of protection, the European
Commission may decide, by an implementing act, that a third country, a territory
or one or more specified sectors thereof, or an international organization ensures an
adequate level of protection (article 45(3)).
163
A list of the third countries, territories, and specified sectors within third countries
and international organizations for which the Commission has decided that an
adequate level of protection is or is no longer ensured is to be published in the
Official Journal of the European Union (article 45(8)).
Absent an adequacy decision, a controller or processor may still transfer personal
data to a third country or an international organization, according to article 46 of the
GDPR, if it has provided “appropriate safeguards”, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
Such safeguards may be provided for, without a specific authorization from a
supervisory authority, by: (1) a legally binding and enforceable instrument between
public authorities or bodies; (2) binding corporate rules; (3) standard data protection
clauses adopted by the Commission; (4) standard data protection clauses adopted by
a supervisory authority and approved by the Commission; (5) an approved code of
conduct together with binding and enforceable commitments of the controller or
processor in the third country to apply the appropriate safeguards; or (6) an approved
certification mechanism together with binding and enforceable commitments of the
controller or processor in the third country to apply the appropriate safeguards,
including as regards data subjects’ rights.
In the absence of either an adequacy decision or appropriate safeguards, a transfer
of personal data to a third country or an international organization may only occur in
one of the cases laid down in article 49 of the GDPR, namely: (1) the data subject has
explicitly consented to the proposed transfer, after having been informed of the
possible risks of such transfers; (2) the transfer is necessary for the performance of a
contract between the data subject and the controller or the implementation of
pre-contractual measures taken at the data subject’s request; (3) the transfer is
necessary for the conclusion or performance of a contract concluded in the interest
of the data subject; (4) the transfer is necessary for important reasons of public
interest; (5) the transfer is necessary for the establishment, exercise or defense of
legal claims; (6) the transfer is necessary in order to protect the vital interests of the
data subject or of other persons, where the data subject is physically or legally
incapable of giving consent; (7) the transfer is made from a register which according
to Union or Member State law is intended to provide information to the public and
which is open to consultation.
162 See ibidem, para. 73.
163 See, on this, the communication from the Commission to the European Parliament and the
Council “Exchanging and Protecting Personal Data in a Globalized World”, COM (2017) 7 final,
published on 10 January 2017.
36
D. Moura Vicente and S. de Vasconcelos Casimiro
that is “essentially equivalent to that guaranteed within the European Union”.
162
After having assessed the adequacy of the level of protection, the European
Commission may decide, by an implementing act, that a third country, a territory
or one or more specified sectors thereof, or an international organization ensures an
adequate level of protection (article 45(3)).
163
A list of the third countries, territories, and specified sectors within third countries
and international organizations for which the Commission has decided that an
adequate level of protection is or is no longer ensured is to be published in the
Official Journal of the European Union (article 45(8)).
Absent an adequacy decision, a controller or processor may still transfer personal
data to a third country or an international organization, according to article 46 of the
GDPR, if it has provided “appropriate safeguards”, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
Such safeguards may be provided for, without a specific authorization from a
supervisory authority, by: (1) a legally binding and enforceable instrument between
public authorities or bodies; (2) binding corporate rules; (3) standard data protection
clauses adopted by the Commission; (4) standard data protection clauses adopted by
a supervisory authority and approved by the Commission; (5) an approved code of
conduct together with binding and enforceable commitments of the controller or
processor in the third country to apply the appropriate safeguards; or (6) an approved
certification mechanism together with binding and enforceable commitments of the
controller or processor in the third country to apply the appropriate safeguards,
including as regards data subjects’ rights.
In the absence of either an adequacy decision or appropriate safeguards, a transfer
of personal data to a third country or an international organization may only occur in
one of the cases laid down in article 49 of the GDPR, namely: (1) the data subject has
explicitly consented to the proposed transfer, after having been informed of the
possible risks of such transfers; (2) the transfer is necessary for the performance of a
contract between the data subject and the controller or the implementation of
pre-contractual measures taken at the data subject’s request; (3) the transfer is
necessary for the conclusion or performance of a contract concluded in the interest
of the data subject; (4) the transfer is necessary for important reasons of public
interest; (5) the transfer is necessary for the establishment, exercise or defense of
legal claims; (6) the transfer is necessary in order to protect the vital interests of the
data subject or of other persons, where the data subject is physically or legally
incapable of giving consent; (7) the transfer is made from a register which according
to Union or Member State law is intended to provide information to the public and
which is open to consultation.
162 See ibidem, para. 73.
163 See, on this, the communication from the Commission to the European Parliament and the
Council “Exchanging and Protecting Personal Data in a Globalized World”, COM (2017) 7 final,
published on 10 January 2017.
36
D. Moura Vicente and S. de Vasconcelos Casimiro