SkarpChapter 5 of 16
International Transfers Without Diluting Union Protection
Personal data may cross borders, but the protection attached to it must not disappear at the Union's edge. The transfer recitals set out a layered system of adequacy decisions, safeguards, corporate rules, derogations, and limits on unsupported foreign disclosure demands.
1. The Transfer Baseline: Protection Travels with the Data
Cross-border data is expected
Recital (101) recognises that data flows to and from countries outside the Union and international organisations are necessary for trade and cooperation.
Protection must travel
Its baseline is exact: "the level of protection of natural persons ensured in the Union by this Regulation should not be undermined".
Onward transfers count
The same concern includes a later transfer from the first third-country or international recipient to another recipient outside the Union.
A conditional permission
Recital (101) says transfers may only be carried out in full compliance with the Regulation and its transfer conditions.
2. Agreements and Adequacy Decisions
Agreements remain relevant
Recital (102) preserves qualifying international agreements between the Union and third countries that regulate transfers and include appropriate safeguards.
Member State condition
A Member State may conclude such an agreement only as far as it does not affect the Regulation or other Union law and includes appropriate rights protection.
What adequacy can cover
Under Recital (103), the Commission may assess a whole third country, a territory, a specified sector, or an international organisation.
Effect of adequacy
Where the Commission has made that decision, transfers may take place without the need to obtain any further authorisation.
3. What 'Adequate' Means and How It Is Kept Under Review
Adequacy is broader than privacy rules
Recital (104) says the assessment should consider the rule of law, access to justice, human-rights standards, and relevant general and sectoral law.
Essential equivalence
"The third country should offer guarantees ensuring an adequate level of protection essentially equivalent to that ensured within the Union".
Rights and oversight matter
The recital identifies independent supervision, cooperation mechanisms, enforceable rights, and effective administrative and judicial redress.
Adequacy is monitored
Recital (106) says the Commission should monitor decisions and include a periodic review mechanism that considers relevant developments.
4. Decision Exercise: A Country Loses Adequacy
Recital (107): what changes when adequacy no longer exists?
Imagine that the Commission recognises that an international organisation no longer ensures an adequate level of data protection.
Pause and decide
Which conclusion best follows from Recital (107)?
- Every transfer can continue because the organisation once had adequacy.
- Transfer should be prohibited unless the Regulation's requirements on appropriate safeguards, including binding corporate rules, or derogations for specific situations are fulfilled.
- The controller may transfer whenever it considers the transfer commercially useful.
Correct reasoning: option 2. Recital (107) says the transfer of personal data to that third country or international organisation should be prohibited, unless requirements relating to transfers subject to appropriate safeguards, including binding corporate rules, and derogations for specific situations are fulfilled.
The recital also envisages consultations. The Commission should, in a timely manner, inform the third country or international organisation of the reasons and enter into consultations to remedy the situation.
Key distinction
An adequacy decision can create a route for transfers. If adequate protection is no longer ensured, Recital (107) directs attention to other transfer routes described by the Regulation rather than treating earlier adequacy as permanent.
Under Recital (107), what follows where the Commission recognises that a third country or international organisation no longer ensures an adequate level of data protection?
- Transfers automatically continue because an adequacy decision previously existed.
- Transfers should be prohibited unless requirements concerning appropriate safeguards, including binding corporate rules, or derogations for specific situations are fulfilled.
- Transfers are permitted whenever the controller has a commercial reason.
Show Answer
Answer: B) Transfers should be prohibited unless requirements concerning appropriate safeguards, including binding corporate rules, or derogations for specific situations are fulfilled.
Recital (107) says transfer should be prohibited in that situation unless the Regulation's requirements on appropriate safeguards, including binding corporate rules, or derogations for specific situations are fulfilled.
5. No Adequacy Decision: Appropriate Safeguards
The absence-of-adequacy response
Recital (108) says: "In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject."
Examples of safeguards
The recital lists binding corporate rules, Commission clauses, supervisory-authority clauses, and contractual clauses authorised by a supervisory authority.
What safeguards should deliver
They should support Union-appropriate protection, enforceable data-subject rights, effective legal remedies, redress, and claims for compensation.
Public-authority arrangements
For non-legally-binding administrative arrangements, Recital (108) says authorisation by the competent supervisory authority should be obtained.
6. Building Safeguards into Contracts and Corporate Groups
Clauses can sit in a wider contract
Recital (109) says standard data-protection clauses may be included in a wider contract, including a contract between a processor and another processor.
But additions have limits
Extra clauses or safeguards must not contradict the standard clauses, directly or indirectly, or prejudice data subjects' fundamental rights or freedoms.
Group-wide route
Recital (110) says a group should be able to use approved binding corporate rules for transfers to organisations within the same group.
Essential condition
Those corporate rules must include all essential principles and enforceable rights needed to ensure appropriate safeguards.
7. Specific-Situation Derogations
Specific circumstances
Recital (111) identifies explicit consent, occasional and necessary contract or legal-claim transfers, public-interest grounds, and qualifying register transfers.
A register is not a blank cheque
A register transfer should not involve all personal data or entire categories of data. Further conditions apply where access is for persons with a legitimate interest.
Public-interest illustrations
Recital (112) gives examples including competition, tax, customs, financial supervision, social security, public health, and anti-doping activity.
Vital interests
A transfer should be regarded as lawful where it is necessary to protect vital interests, including physical integrity or life, if the data subject cannot give consent.
8. The Narrow Residual Route: Compelling Legitimate Interests
A narrow category
Recital (113) concerns transfers that are not repetitive, concern only a limited number of data subjects, and rely on compelling legitimate interests.
Assess the entire context
The controller should consider the data's nature, the purpose and duration of processing, and the origin, third-country, and final-destination situations.
Residual means residual
"Such transfers should be possible only in residual cases where none of the other grounds for transfer are applicable."
Information duty in the recital
Recital (113) says the controller should inform the supervisory authority and the data subject about the transfer.
9. Checkpoint: Which Route Is Last?
Apply Recital (113)
A controller wants to rely on compelling legitimate interests for a recurring transfer programme involving thousands of data subjects. It has not checked whether another transfer ground is available.
Choose the best answer based on Recital (113).
Why does this proposal not fit Recital (113) as described?
- Compelling legitimate interests may be used for any transfer where the controller prefers them.
- The recital describes a residual possibility for transfers that are not repetitive, concern only a limited number of data subjects, and apply where none of the other grounds is applicable.
- Recital (113) permits this route only for public authorities.
Show Answer
Answer: B) The recital describes a residual possibility for transfers that are not repetitive, concern only a limited number of data subjects, and apply where none of the other grounds is applicable.
Recital (113) characterises this route as limited and residual. It says such transfers should be possible only where none of the other grounds for transfer are applicable, and describes transfers that are not repetitive and concern only a limited number of data subjects.
10. Foreign Disclosure Demands Do Not Bypass the Transfer Conditions
Rights should continue
Under Recital (114), without an adequacy decision, controllers or processors should use solutions providing enforceable and effective rights after transfer.
The foreign-demand scenario
Recital (115) describes foreign judgments or administrative decisions demanding disclosure where no qualifying international agreement is in force.
No bypass
"Transfers should only be allowed where the conditions of this Regulation for a transfer to third countries are met."
A qualified illustration
The recital says this may include disclosure necessary for an important public-interest ground recognised in Union or Member State law to which the controller is subject.
11. Rapid Review: Transfer Vocabulary
Flip each card and test your precision
Focus on the conditions and qualifiers used in Recitals (101) to (116).
- Transfer baseline
- Recital (101): "the level of protection of natural persons ensured in the Union by this Regulation should not be undermined", including in cases of onward transfers.
- Adequacy decision
- Recital (103): the Commission may decide that a third country, territory, specified sector, or international organisation offers an adequate level of protection. Transfers may then take place without further authorisation.
- Essential equivalence
- Recital (104): "The third country should offer guarantees ensuring an adequate level of protection essentially equivalent to that ensured within the Union".
- Appropriate safeguards
- Recital (108): in the absence of adequacy, the controller or processor should take measures to compensate through appropriate safeguards for the data subject.
- Binding corporate rules
- Recital (110): approved rules usable by a group for transfers to organisations within the same group, provided they contain essential principles and enforceable rights.
- Residual compelling legitimate interests
- Recital (113): a possible route for not repetitive transfers concerning only a limited number of data subjects, and only in residual cases where no other transfer ground applies.
- Third-country disclosure demand
- Recital (115): "Transfers should only be allowed where the conditions of this Regulation for a transfer to third countries are met."
- International cooperation
- Recital (116): the Commission and supervisory authorities should exchange information and cooperate with competent third-country authorities based on reciprocity and in accordance with the Regulation.
Key Terms
- processor
- A role referred to throughout the transfer recitals as one that must comply with the Regulation's transfer conditions where it carries out a transfer.
- controller
- A role referred to throughout the transfer recitals as one that must comply with the Regulation's transfer conditions where it carries out a transfer.
- data subject
- The natural person whose personal data and related rights are protected in the transfer recitals.
- third country
- A country outside the Union, as used throughout Recitals (101) to (116).
- onward transfer
- A later transfer from a third country or international organisation to a controller or processor in the same or another third country or international organisation, described in Recital (101).
- adequacy decision
- A Commission decision described in Recital (103) that a third country, a territory, a specified sector within a third country, or an international organisation offers an adequate level of data protection.
- appropriate safeguards
- Measures described in Recital (108) to compensate for the lack of data protection in a third country where there is no adequacy decision.
- binding corporate rules
- Approved rules that Recital (110) says a group of undertakings or enterprises engaged in a joint economic activity should be able to use for qualifying intra-group international transfers.
- international organisation
- An organisation outside the Union that may receive transferred personal data and may be the subject of an adequacy assessment under Recital (103).
- derogations for specific situations
- Possible transfer circumstances described in Recitals (111) and (112), including explicit consent, certain occasional and necessary transfers, public-interest grounds, and specified vital-interest situations.