February 19, 2018

The document builds on the previous work done by the Working Party regarding central questions raised by the application of derogations in the context of transfers of personal data to third countries. The Working Party says that the document will be reviewed and if necessary updated, based on the practical experience gained through the application of the GDPR.

The Working Party explains that when applying Article 49 it must be borne in mind that according to Article 44 GDPR, any transfer of personal data to third countries or international organisations must also meet the conditions of the other provisions of the GDPR. Each processing activity must comply with the data protection principles in Article 5, and in particular, be lawful in accordance with Article 6. Hence, a two-step test must be applied: first, a lawful basis must apply to the data processing itself, together with all relevant provisions of the GDPR; and as a second step, the provisions of Chapter V must be complied with.

Article 49 (1) states that in the absence of an adequacy decision or of appropriate safeguards, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only under certain conditions. At the same time, Article 44 requires all provisions in Chapter V to be applied in such a way as to ensure that the level of protection of natural persons guaranteed by the GDPR is not undermined. This also implies that recourse to the derogations of Article 49 should never lead to a situation where fundamental rights might be breached.

According to the Guidelines, data controllers should consider first, whether the third country provides an adequate level of protection and, if not, the data controller should consider providing adequate safeguards. Data exporters should first endeavour to frame the transfer within one of the mechanisms included in Articles 45 and 46 GDPR, and only in their absence use the derogations provided in Article 49(1).

Derogations under Article 49 are therefore exemptions from the general principle that personal data may only be transferred to third countries if an adequate level of protection is provided for in the third country or if appropriate safeguards have been adduced, and the data subjects enjoy enforceable and effective rights in order to continue to benefit from their fundamental rights and safeguards.

When considering the transfer of personal data to third countries or international organisations, data controllers should therefore favour solutions that provide data subjects with a guarantee that they will continue to benefit from the fundamental rights and safeguards to which they are entitled as regards processing of their data once this data has been transferred. As derogations do not provide adequate protection or appropriate safeguards for the personal data transferred, and as transfers based on a derogation are not required to have any kind of prior authorisation from the supervisory authorities, transferring personal data to third countries on the basis of derogations leads to increased risks for the rights and freedoms of the data subjects concerned. The consultation is open until 26 March 2018. To access the consultation and for further details as to how to respond, click here.