{"id":349,"date":"2019-08-19T14:59:07","date_gmt":"2019-08-19T14:59:07","guid":{"rendered":"http:\/\/www.dataprotectionconsultant.it\/EN\/?p=349"},"modified":"2022-09-05T08:02:18","modified_gmt":"2022-09-05T08:02:18","slug":"transfer-of-personal-data-to-third-countries-or-international-organisations","status":"publish","type":"post","link":"https:\/\/www.dataprotectionconsultant.it\/EN\/transfer-of-personal-data-to-third-countries-or-international-organisations\/","title":{"rendered":"Transfer of personal data to third countries or international organisations"},"content":{"rendered":"

\"\"<\/a> \"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

Transfer of personal data to third countries or international organisations<\/strong><\/span><\/p>\n

Requirements for the transfer of personal data to third countries or international organisations<\/strong><\/span><\/p>\n

The previous requirements for the lawful transfer of personal data to third countries (outside the European Union and the Economic European Area \u2013 \u00abEEA<\/em>\u00bb) are confirmed, apart from some exceptions.<\/strong><\/span><\/p>\n

Data can be transferred to third countries or international organisations if at least one of the following applies:<\/strong><\/span><\/p>\n

a. adequacy of the third country determined by a decision of the European Commission <\/strong><\/span><\/p>\n

b. in the absence of decision of adequacy of the Commission, the controllers and processors<\/a><\/span><\/span> involved may transfer personal data if appropriate safeguards are put in place, such as:<\/strong><\/span><\/p>\n

a. binding corporate rules (\u00abBCRs\u00bb)<\/strong><\/span><\/p>\n

b. standard data protection clauses adopted by the Commission for the transfer from a controller to a controller and from a controller to a processor<\/a><\/span><\/strong><\/span><\/p>\n

c. in the absence of any other requirement, there are derogations for specific situations, such as the data subject\u2019s consent<\/a>,<\/span><\/span> or when data processing is necessary for the performance of a contract or for the establishment, exercise, or defence of legal claims.<\/strong><\/span><\/p>\n

Transfer on the basis of an adequacy decision <\/strong><\/span><\/p>\n

The adequacy decisions issued<\/span> by the Commission (that is the level of protection in third countries) as well as the international agreements and decisions issued before the 24th of\u00a0May 2016 by the Member States shall remain valid until amended, replaced, or repealed<\/span>. This means that the national authorisations issued by the supervisory authorities after the adequacy decisions of the Commission are still in force.<\/strong><\/span><\/p>\n

So far, the adequacy decisions in force concern the following countries: Andorra, Argentina, Australia \u2013 PNR, Canada, Faer Oer, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay, Japan. As for the EEA, the decisions concern Norway, Liechtenstein, Island.\u00a0<\/strong><\/span><\/p>\n

Binding Corporate Rules (\u00abBCRs\u00bb)<\/strong><\/span><\/p>\n

The GDPR determines the requirements for the approval of the binding corporate rules and what they shall specify. The list provided by the GDPR is not exhaustive; therefore, the competent authorities may issue further requirements, as appropriate. However, the approval flow is quite complex and the European\u00a0Data Protection Board (\u00abEDPB\u00bb) shall be involved.<\/strong><\/span><\/p>\n

Transfer subject to appropriate safeguards<\/strong><\/span><\/p>\n

In addition to the binding corporate rules, appropriate safeguards include the standard contractual clauses issued by the European Commission for transfers from EU controller to extra-EU controller and from EU controller to extra-EU processor<\/a><\/span><\/span>.<\/span> The clauses already issued are still in force<\/span>. It is the most widely adopted mechanism for the transfer of personal data to third countries. The \u00abPrivacy Shield\u00bb is also considered a suitable safeguard. The GDPR has added to these appropriate safeguards the adherence to an approved code of conduct<\/a><\/span> or an approved certification<\/a><\/span><\/span> mechanism.<\/strong><\/span><\/p>\n

Derogations for specific situations<\/strong><\/span><\/p>\n

In the absence of the previously mentioned requirements, the transfer of personal data to third countries may be carried out with the data subject\u2019s consent<\/a><\/span> or if the transfer is necessary for the performance of a contract between the controller and the person or for the implementation of pre-contractual measures taken at the data subject’s request<\/span>. Personal data may be transferred also if necessary for the establishment, exercise or defence of legal claims or for important reasons of public interest and for the protection of the vital interests of the data subject or of other persons and the data subject is physically or legally incapable of giving consent<\/a><\/span>. <\/span><\/span><\/strong><\/span><\/p>\n

What has changed with the GDPR<\/strong><\/span><\/p>\n

The GDPR introduces the codes of conduct<\/a><\/span> and the certification<\/a><\/span> mechanism which may be produced as an appropriate safeguard. Besides, no authorisation by the supervisory authority is required<\/span>. This means that the transfer to an adequate third country based on a Commission decision or on the basis of the standard contractual clauses adopted or of the BCRs may take place without the supervisory authority\u2019s prior authorisation. The supervisory authority\u2019s prior authorisation shall be necessary if the controller intends to use specific contractual clauses (that is clauses which are different from the clauses issued by the European Commission) or for administrative arrangements between public authorities<\/span>.<\/strong><\/span><\/p>\n

 <\/p>\n

To learn more, click here<\/a>,<\/span><\/span> read FAQs<\/a><\/span><\/span> or contact me<\/a><\/span>.<\/strong><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

    Transfer of personal data to third countries or international organisations Requirements for the transfer of personal data to third countries or international organisations The previous requirements for the lawful transfer of personal data to third countries (outside the European Union and the Economic European Area \u2013 \u00abEEA\u00bb) are confirmed, apart from some exceptions. … <\/p>\n

Continue reading “Transfer of personal data to third countries or international organisations”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/349"}],"collection":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/comments?post=349"}],"version-history":[{"count":19,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/349\/revisions"}],"predecessor-version":[{"id":1373,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/posts\/349\/revisions\/1373"}],"wp:attachment":[{"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/media?parent=349"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/categories?post=349"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dataprotectionconsultant.it\/EN\/wp-json\/wp\/v2\/tags?post=349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}