Transfer to countries not guaranteeing an adequate level of protection

Unless the Commission has issued a decision on adequacy, or canceled the decision on adequacy, the operator or intermediary can still use the following institutes for transmission:

1. The operator or intermediary has provided adequate guarantees and the affected persons have available enforceable rights and effective legal remedies and this is a cumulative fulfillment of the conditions. Subsequently, it is possible to choose from the following options:

1. it is not necessary to ask the supervisory authority for a special permission for use
   1. legally binding and enforceable instrument between public authorities or public entities;
   2. binding internal company rules;
   3. standard data protection clauses adopted by the Commission;
      • Commission Decision (EU) 2021/914 may be used to transfer personal data between:
        • operator in the EU - operator in a third country
        • operator in the EU – intermediary in a third country
        • intermediary in the EU – intermediary in a third country
        • intermediary in the EU - operator in a third country

          On 25 May 2022, the European Commission issued a document entitled Questions and answers for standard contractual clauses under Commission Decision (EU) 2021/914. The document is available in English at this link The New Standard Contractual Clauses – Questions And Answers.

   4. standard data protection clauses adopted by the supervisory authority and approved by the Commission;
   5. an approved code of conduct together with the binding and enforceable obligations of the operator or intermediary in the third country consisting in the application of adequate safeguards, including with regard to the rights of the persons concerned, or
   6. an approved certification mechanism with a binding and enforceable obligation of the operator or intermediary in a third country consisting in the application of adequate guarantees, including with regard to the rights of the persons concerned;
2. it is necessary to ask the supervisory authority for a special permit for use
   1. contractual clauses between the operator or intermediary and the operator, intermediary or recipient of personal data in a third country or international organization, or
   2. provisions that are included in administrative arrangements between public authorities or public entities and include enforceable and effective rights of affected persons.

      If, due to their nature, these means of transmission cannot provide guarantees which would ensure that the level of protection required by Union law is respected, it may be required, depending on the situation existing in a particular third country, that the controller or intermediary take additional measures in order to guarantee compliance with this level of protection. You can find out more about additional measures in the document Recommendations on measures supplementing transfer tools to ensure compliance with the level of personal data protection in the EU and the Supplementary Measures Roadmap.

2. Exceptions for special situations

If there is no decision on adequacy or if there are no adequate guarantees, transfers of personal data to a third country or international organization will only take place under one of the following conditions

1. the affected person expressed explicit consent to the proposed transfer after being informed of the risks that such transfers may pose for him due to the absence of an adequacy decision and adequate safeguards;
2. the transfer is necessary for the performance of the contract between the data subject and the operator or for the implementation of pre-contractual measures taken at the request of the data subject;
3. the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the person concerned between the operator and another natural or legal person;
4. the transfer is necessary for important reasons of public interest;
5. the transfer is necessary for the establishment, exercise or defense of legal claims;
6. the transfer is necessary to protect the vital interests of the data subject or other persons, if the data subject is physically or legally incapable of expressing consent;
7. the transfer is carried out from a register which, according to the law of the Union or the law of a Member State, is intended for providing information to the public and which is open to inspection by the public or any person who can demonstrate a legitimate interest, but only if the conditions established by Union law are met in this particular case or the Member State's right of inspection.

3. Single transfer of personal data

If the operator cannot use any of the above-mentioned institutes, the transfer of personal data can only take place if the following cumulative criteria are met:

• the transfer is not of a recurring nature,
• concerns only a limited number of affected persons,
• is necessary for the purposes of serious legitimate interests pursued by the operator and which are not overridden by the interests or rights and freedoms of the person concerned,
• and the operator has assessed all the circumstances surrounding the transfer of data and, based on this assessment, has provided appropriate guarantees regarding the protection of personal data.

The operator informs the supervisory authority about the transfer. In addition to fulfilling the information obligation towards the affected person, the operator also informs the affected person about the transfer and about the important legitimate interests that he is pursuing.