101
Transfers with an adequacy decision
1. A transfer may take place where the Commission has decided that the
third country, or a territory or a processing sector within that third country,
or the international organisation in question ensures an adequate level of
protection. Such transfer shall not require any specific authorisation.
2. When assessing the adequacy of the level of protection, the
Commission shall give consideration to the following elements:
(a) the rule of law, relevant legislation in force, both general and sectoral,
including concerning public security, defence, national security and
criminal law as well as the implementation of this legislation, the
professional rules and security measures which are complied with in that
country or by that international organisation, jurisprudential precedents,
as well as effective and enforceable rights including effective
administrative and judicial redress for data subjects, in particular for those
data subjects residing in the Union whose personal data are being
transferred;
(b) the existence and effective functioning of one or more independent
supervisory authorities in the third country or international organisation in
question responsible for ensuring compliance with the data protection
rules, including sufficient sanctioning powers, for assisting and advising
the data subjects in exercising their rights and for co-operation with the
supervisory authorities of the Union and of Member States; and
(c) the international commitments the third country or international
organisation in question has entered into, in particular any legally
binding conventions or instruments with respect to the protection of
personal data.
3. The Commission shall be empowered to adopt delegated acts in
accordance with Article 86 to decide that a third country, or a territory or
a processing sector within that third country, or an international
organisation ensures an adequate level of protection within the meaning of
paragraph 2. Such delegated acts shall provide for a sunset clause if they
[Transfers with an adequacy decision
6
1.
A transfer of personal data to a third country or an
international organisation
may take place where the Commission
7
has decided that the third country, or a territory or a processing
one
ore more
specified
sectors
within that third country, or the
international organisation in question ensures an adequate level of
protection. Such transfer shall not require any further
specific
authorisation.
2.
When assessing the adequacy of the level of protection, the
Commission shall, give considering to
in particular, take account of
the following elements:
(a)
the rule of law, respect for
human rights and fundamental
freedoms
, relevant legislation
in force
8
, both general and sectoral,
including concerning public security, defence, national security and
criminal law, the professional rules
data protection rules
and
security measures, including
rules for onward transfer of personal
data to another third country or international organisation,
which
are complied with in that third
country or international organisation,
as well as effective and enforceable rights including
the existence
of effective and enforceable data subject rights and
effective
administrative and judicial redress for data subjects whose
personal data are being transferred
in particular for those data
subjects residing in the Union whose personal data are being
transferred
9
;
(b)
the existence and effective functioning of one or more
independent supervisory authorities
10
in the third country or to
which an
international organisation in question responsible
is
subject, with responsibility
for ensuring and enforcing
compliance
with the data protection rules including adequate sanctioning
powers for assisting and advising the data subjects in exercising
their rights and for co-operation with the supervisory authorities of
the Union and of Member States; and
(c)
the international commitments the third country or
international organisation concerned
has entered into, or other
106
concern a processing sector and shall be revoked according to
paragraph 5 as soon as an adequate level of protection according to this
Regulation is no longer ensured.
4. The delegated act shall specify its territorial and sectoral application,
and, where applicable, identify the supervisory authority mentioned in
point (b) of paragraph 2.
4a. The Commission shall, on an on-going basis, monitor developments
in third countries and international organisations that could affect the
elements listed in paragraph 2 where a delegated act pursuant to
paragraph 3 has been adopted.
5. The Commission shall be empowered to adopt delegated acts in
accordance with Article 86 to decide that a third country, or a territory or
a processing sector within that third country, or an international
organisation does not ensure or no longer ensures an adequate level of
protection within the meaning of paragraph 2 of this Article, in particular
in cases where the relevant legislation, both general and sectoral, in force
in the third country or international organisation, does not guarantee
effective and enforceable rights including effective administrative and
judicial redress for data subjects, in particular for those data subjects
residing in the Union whose personal data are being transferred.
6. Where the Commission decides pursuant to paragraph 5, any transfer of
personal data to the third country, or a territory or a processing sector
within that third country, or the international organisation in question shall
be prohibited, without prejudice to Articles 42 to 44. At the appropriate
time, the Commission shall enter into consultations with the third country
or international organisation with a view to remedying the situation
resulting from the decision made pursuant to paragraph 5 of this Article.
6a. Prior to adopting a delegated act pursuant to paragraphs 3 and 5,
the Commission shall request the European Data Protection Board to
provide an opinion on the adequacy of the level of protection. To that
end, the Commission shall provide the European Data Protection Board
with all necessary documentation, including correspondence with the
obligations arising from its participation in multilateral or regional
systems
, in particular
in relation to the protection of personal data
.
2a.
The European Data Protection Board shall give the
Commission an opinion
11
for the assessment of the adequacy of
the level of protection in a third country or international
organization, including for the assessment whether a third country
or the territory or the international organization or the specified
sector no longer ensures an adequate level of protection
.
3.
The Commission, after assessing the adequacy
12
of the level
of protection,
may decide that a third country, or a territory or a
processing
one or more
specified
sectors
within that third country,
or an international organisation ensures an adequate level of
protection within the meaning of paragraph 2.
13
The implementing
act shall specify its territorial and sectoral application and, where
applicable, identify the (independent) supervisory authority
(ies)
mentioned in point (b) of paragraph 2.
Those
T he
implementing
acts
shall be adopted in accordance with the examination
procedure referred to in Article 87(2)
14
.
3 a.
15
Decisions adopted by the Commission on the basis of Article
25(6) or Article 26(4)
of Directive 95/46/EC shall remain in force
until amended, replaced or repealed by the Commission
16
in
accordance with the examination procedure referred to in Article
87(2)
17
.
4.
The implementing act shall specify its geographical and
sectoral application, and, where applicable, identify the supervisory
authority mentioned in point (b) of paragraph 2.
4a.
The Commission shall monitor the functioning of decisions
adopted pursuant to paragraph 3 and decisions adopted on the
basis of Article 25(6) or Article 26(4) of Directive 95/46/EC
18
.
5.
The Commission may decide that a third country, or a
territory or a processing
specified
sector within that third country, or
an international organisation does not
no longer
ensures an
adequate level of protection within the meaning of paragraph 2 of
this Article, in particular in cases where the relevant legislation,
82
government of the third country, territory or processing sector within
that third country or the international organisation.
7. The Commission shall publish in the Official Journal of the European
Union and on its website a list of those third countries, territories and
processing sectors within a third country and international organisations
where it has decided that an adequate level of protection is or is not
ensured.
8. Decisions adopted by the Commission on the basis of Article 25(6) or
Article 26(4) of Directive 95/46/EC shall remain in force until five years
after the entry into force of this Regulation unless amended, replaced or
repealed by the Commission before the end of this period.
both general and sectoral, in force in the third country or
international organisation, does not guarantee effective and
enforceable rights including effective administrative and judicial
redress for data subjects, in particular for those data subjects
residing in the Union whose personal data are being transferred
and may, where necessary, repeal, amend or suspend such
decision without retro-active effect.
Those
T he
implementing acts
shall be adopted in accordance with the examination procedure
referred to in Article 87(2) or, in cases of extreme urgency for
individuals with respect to their right to personal data protection
, in
accordance with the procedure referred to in Article 87(3)
19
.
5 a.
20
At the appropriate time, t
T
he Commission shall enter into
consultations with the third country or international organisation
with a view to remedying the situation resulting from
giving rise to
the Decision made pursuant to paragraph 5 of this Article
.
6.
Where the Commission decides
A decision
pursuant to
paragraph 5,
any
is without prejudice to
transfers
of personal data
to the third country, or a
the
territory or processing
specified
sector
within that third country, or the international organisation in question
shall be prohibited, without prejudice
pursuant
to Articles 42 to 44
21
.
At the appropriate time, the Commission shall enter into
consultations with the third country or international organisation
with a view to remedying the situation resulting from the Decision
made pursuant to paragraph 5 of this Article.
22
7.
The Commission shall publish in the Official Journal of the
European Union a list of those third countries, territories and
processing
specified
sectors within a third country and international
organisations where it has decided that an adequate level of
protection is or is not ensured
in respect of which decisions have
been taken pursuant to paragraphs 3, 3a
and
5 .
8.
23
Decisions adopted by the Commission on the basis of Article
25(6) or Article 26(4) of Directive 95/46/EC shall remain in force,
until amended, replaced or repealed by the Commission
.]
24
Documents you may be interested
Documents you may be interested
