4.3 International Data Transfers
A basic goal of the development of common rules on the protection of personal data
within the EU is to ensure the free flow of data. Therefore, Article 1(3) of the GDPR
makes clear that the free movement of personal data within the Union shall be neither
restricted nor prohibited for reasons connected with the protection of natural persons
with regard to the processing of personal data. However, in order to ensure that when
the personal data of Europeans are transferred abroad the protection level is not
undermined, transfers of personal data to third countries or international organisations are only allowed if the conditions laid down in Chapter V of the GDPR are
complied with by the controller and processor. These provisions are based on the
significant enforcement experience in this area developed by the EU in previous
years.
37
Transfers to a non-EU country may take place without further safeguards or a
specific authorisation on the basis of a Commission “adequacy decision”
establishing that a third country—or a particular territory of a third country, or a
specific sector or industry within a third country—provides a level of data protection
that is essentially equivalent to that in the EU.
38 Article 45(2) GDPR contains a
catalogue of elements that the Commission must take into account when adopting
decisions on adequacy, which include: the rule of law, respect for human rights and
relevant legislation, as well as the implementation of such legislation; the existence
and effective functioning of independent supervisory authorities; and the international commitments the third country or international organisation concerned has
entered into. The EU-US Privacy Shield is a self-certification mechanism for US
based companies which has been recognized by the Commission as providing an
adequate level of protection for personal data transferred from an EU entity to US
based companies. It is in full effect since 1August 2016.
In the absence of an adequacy decision, a controller or processor may transfer
personal data to a third country or an international organisation only if the controller
or processor provides appropriate safeguards, and on condition that enforceable data
subject rights and effective legal remedies for data subjects are available. Instruments to provide adequate safeguards without requiring a specific authorisation from
a supervisory authority include: standard contractual clauses establishing obligations
between the EU exporter and the third country importer; binding corporate rules
adopted by a multinational group of companies a group of enterprises engaged in a
joint economic activity to carry out transfers within the group; and approved codes of
conduct or certification mechanisms.
Where no adequacy decision is applicable and no appropriate safeguards have
been provided pursuant to Article 46 GDPR, transfers of personal data to a third
country are only allowed under one of the conditions laid down in Article 49 GDPR.
37 See Kuner (2013), pp. 151–154.
38 Judgment of the CJEU of 6 October 2015, C-362/14, Schrems v. Data Protection Commissioner,
ECLI:EU:C:2015:6506, paras. 73–74.
Data Protection in the Internet: A European Union Perspective
475
A basic goal of the development of common rules on the protection of personal data
within the EU is to ensure the free flow of data. Therefore, Article 1(3) of the GDPR
makes clear that the free movement of personal data within the Union shall be neither
restricted nor prohibited for reasons connected with the protection of natural persons
with regard to the processing of personal data. However, in order to ensure that when
the personal data of Europeans are transferred abroad the protection level is not
undermined, transfers of personal data to third countries or international organisations are only allowed if the conditions laid down in Chapter V of the GDPR are
complied with by the controller and processor. These provisions are based on the
significant enforcement experience in this area developed by the EU in previous
years.
37
Transfers to a non-EU country may take place without further safeguards or a
specific authorisation on the basis of a Commission “adequacy decision”
establishing that a third country—or a particular territory of a third country, or a
specific sector or industry within a third country—provides a level of data protection
that is essentially equivalent to that in the EU.
38 Article 45(2) GDPR contains a
catalogue of elements that the Commission must take into account when adopting
decisions on adequacy, which include: the rule of law, respect for human rights and
relevant legislation, as well as the implementation of such legislation; the existence
and effective functioning of independent supervisory authorities; and the international commitments the third country or international organisation concerned has
entered into. The EU-US Privacy Shield is a self-certification mechanism for US
based companies which has been recognized by the Commission as providing an
adequate level of protection for personal data transferred from an EU entity to US
based companies. It is in full effect since 1August 2016.
In the absence of an adequacy decision, a controller or processor may transfer
personal data to a third country or an international organisation only if the controller
or processor provides appropriate safeguards, and on condition that enforceable data
subject rights and effective legal remedies for data subjects are available. Instruments to provide adequate safeguards without requiring a specific authorisation from
a supervisory authority include: standard contractual clauses establishing obligations
between the EU exporter and the third country importer; binding corporate rules
adopted by a multinational group of companies a group of enterprises engaged in a
joint economic activity to carry out transfers within the group; and approved codes of
conduct or certification mechanisms.
Where no adequacy decision is applicable and no appropriate safeguards have
been provided pursuant to Article 46 GDPR, transfers of personal data to a third
country are only allowed under one of the conditions laid down in Article 49 GDPR.
37 See Kuner (2013), pp. 151–154.
38 Judgment of the CJEU of 6 October 2015, C-362/14, Schrems v. Data Protection Commissioner,
ECLI:EU:C:2015:6506, paras. 73–74.
Data Protection in the Internet: A European Union Perspective
475