Article 45 GDPR
Legal Text
1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.
2. When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements:
- (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred;
- (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and
- (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data.
3. The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).
4. The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC.
5. The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).
On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3).
6. The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5.
7. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49.
8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured.
9. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article.
Relevant Recitals
Commentary
Article 45 GDPR refers to the complex issue of international data transfers. The huge amounts of data transferred from the EU to third countries created the necessity to adopt provisions that could ensure the implementation of precautionary measures to protect the transfers. The level of protection that should be achieved is promoted and delimitated in Chapter V of the GDPR. Chapter V of the GDPR creates a three-tiered structure for legal bases for international data transfers, with adequacy decisions being at the top, appropriate safeguards at the middle and negotiations at the bottom.[1]
On the basis of Art. 45 GDPR the European Commission has the power to determine, whether a country outside the EU offers an adequate, "essentially equivalent" level of data protection with the EU. Adequacy means that the rules implemented in the third countries or international organisations are effective in practice[2]. The European Commission has so far recognised the following countries as providing adequate protection by means of 'adequacy decisions': Andorra, Argentina, Canada (only commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay. The current adequacy decisions can be found here.
(1) Adequacy Decision
Under Article 45 GDPR, a transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. The expression 'adequate level of protection' means that the third country, by virtue of its national legislation or international obligations, ensures a level of protection of freedoms and fundamental rights which is 'essentially equivalent' to the one guaranteed in the Union in the light of the Charter.[3] Although the resources used by a third country may differ from those used in the EU, they must nevertheless prove to be effective in practice.[4] The main consequence of the adequacy decision is that, if it is adopted, the transfer "shall not require any specific authorisation".
(2) Criteria for the Adequacy Decision
Article 45(2) GDPR sets out a number of criteria that the European Commission must take into account while considering the adoption of an adequacy decision. This list is not exhaustive[5] and includes at least the following elements:
(a) Rule of Law
In assessing the adequacy of a third country the Commission shall take into account, among the others, the rule of law, respect for human rights and fundamental freedoms, relevant legislation, as well as the implementation of such legislation, data protection rules and security measures, including rules for the onward transfer of personal data to another third country, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred.
This criterion assumes a minimum level of human rights and fundamental freedoms. Third countries must ensure the minimum of interference with fundamental rights by providing guarantees for law enforcement and national security access. Clear, precise and accessible rules for data processing. necessity and proportionality must be demonstrated with regards to the legitimate objectives pursued, the processing must be subject to independent oversight, effective remedies must be available to individuals.[6]
This remains true with regard to the fields of national security and public safety. On this issue, the WP29 has also identified four essential guarantees reflecting the jurisprudence of the CJEU and the ECHR in the field of surveillance. In particular, (i) Processing should be based on clear, precise and accessible rules (legal basis); (ii) Necessity and proportionality with regards to legitimate objectives pursued need to be demonstrated; (iii) The processing has to be subject to independent oversight; and (iv) Effective remedies need to be available to the individuals.[7]
(b) Independent Supervisory Authorities
The EU Commission will have to ponder the existence and effective functioning of one or more independent supervisory authorities in the third country, including adequate enforcement powers. The independent effective supervisory authorities shall be mandated to monitor the respect of the third-country or intra-organisational data protection rules. The authorities should also advise data subjects and cooperate with the supervisory authorities of the Member States.[8]
(c) International Obligations
Finally, it should be considered the international commitments the third country or international organisation concerned has entered into, in particular in relation to the protection of personal data. This criterion is intended to verify that the international commitments in question do not conflict with the criteria listed above. On the other hand, the presence of international agreements that promote or facilitate the implementation of a more efficient personal data protection system must be taken into account positively.[9]
Essential elements
The criteria listed above are intended as a guide and should not be understood in an overly restrictive sense. This means that the third country does not have to implement the identical measures of protection provided by the EU in order for their data protection system to be deemed adequate.[10]
That said, certain elements of the European order must always be respected. In particular, from a substantive perspective, a third country’s or international organisation’s system must contain at least the following basic content: (i) Rules on basic data protection concepts and/or principles should exist; (ii) Grounds for lawful and fair processing for legitimate purposes should be set in a sufficiently clear manner; (iii) The principled of purpose limitation, (iv) data quality and proportionality, (v) data retention, (vi) security and confidentiality, and (vii) transparency should be recognized; the data subject should have at least the (viii) the right of access, rectification, erasure and objection, (ix) restrictions on onward transfers are foreseen.
The necessary guarantees are not limited to those of a substantial nature. Indeed, the European authorities have clarified that an adequate level of protection cannot be guaranteed without at least the following elements: (i) the presence of at least one independent, impartial, properly funded supervisory authority with investigative powers; (ii) the existence of a data protection system that is shared and known by controllers and data subjects; (iii) an accountability system for controllers; and, finally, (iv) the existence of effective administrative and judicial redress, including for compensation for damages as a result of the unlawful processing of his/her personal data.[11]
(3) Adoption of the Adequacy Decision
After assessing the adequacy of the level of protection of a third country[12] under paragraph 2, the Commission may decide to adopt an adequacy decision by means of implementing act. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall also provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation.[13]
The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). The process in order to adopt an adequacy decision requires a submission of a proposal from the European Commission, a non-binding opinion from the European Data Protection Board (EDPB), an approval from representatives of EU countries and finally the adoption of the decision by the European Commission.
The significance of the decision is easy to be understood due to its effect. After the adoption of a decision personal data can flow from the EEA to a third country without the requirement of further safeguards needed.[14] The Commission can issue adequacy decisions for any country that is not an EU Member State or party to the EEA, or as the article provides a decision can be issued for an international organisation. So far, the Commission has issued adequacy decisions for a number of countries such as: Andorra, Argentina, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay.[15]
(4) Monitoring of Developments in the third Country
Under Article 35(4) GDPR, following the adoption of an adequacy decision, the Commission must regularly examine whether the finding of adequacy decision is still correct, both objectively and legally. In any event, such an examination is necessary where there are indications which give rise to doubts as to that point. This continuous monitoring of adequacy also requires dialogue with the authorities of the third country concerned. The Commission may also continue to do so with the support of the EDPB in accordance with Article 70(1)(b) GDPR.[16]
(5) Repeal, Amendment or Suspension of the Adequacy Decision
The continued monitoring referred to in paragraph 3, or other information which has come to light, may demonstrate that the third country does not ensure the essentially equivalent level of protection referred to in paragraph 2 and that the initial adequacy decision is therefore no longer correct. In such circumstances, the Commission is required, to the extent necessary, to repeal, amend, or suspend the initial decision by means of implementing acts without retro-active effects.[17] The decision-making procedure referred to in Article 93(2) GDPR shall apply unless there are elements of urgency requiring an immediate decision. In that case, the procedure provided for in Article 93(3) GDPR shall apply. This allows the Commission to react to changes in the situation in the third country or in the international organisation at short notice, where appropriate, and to amend the adequacy decision. Whether there is a duly justified case must be decided on a case-by-case basis.[18]
(6) Mandatory Consultation following the Decision under Paragraph 5
Following the repeal, amendment or suspension decision under paragraph 5, the Commission has to enter into consultations with the third country or the international organisation in order to remedy the situation.[19] The aim of the negotiations with the Commission is to encourage the third country or international organisation to raise the level of protection of personal data again and to bring it closer to European standards.
(7) Transfers in case of Repeal, Amendment or Suspension of the Adequacy Decisionn
This provision clarifies that in case the Commission withdraws a previous decision or, in more limited terms, suspends or amends it, transfers can nevertheless take place according to the other instruments provided for in Articles 46-49 of the GDPR (e.g. standard contractual clauses or binding corporate rules). The provision expresses a general principle and applies not only to the case provided for in paragraph 5 but also to the hypothesis that an adequacy decision has never been adopted.
(8) Adequacy Decisions shall be Published
The Commission's adequacy decision for third countries, their territories and specific sectors, as well as for international organisations, must be taken by the Commission in accordance with the latter. Abs. 8 be published in the Official Journal of the European Union and on the Commission's website.[20]
(9) Continued Validity
Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article
Decisions
→ You can find all related decisions in Category:Article 45 GDPR
References
- ↑ Kuner, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 45 GDPR, p. 774 (Oxford University Press 2020).
- ↑ WP29, Adequacy Referential, WP 254 rev.01, 28 November 2017, p. 3 (available here).
- ↑ CJEU, C-311/18, Facebook Ireland and Schrems, ECLI:EU:C:2020:559, 16 July 2020, margin number 94. The WP29 adhered to this interpretation, further stating that the third country's rules must comply with a "core" of principles relating both to the content of data protection rules and their enforcement, based on the GDPR, the Charter of Fundamental Rights of the European Union (CFR) and other relevant international instruments, such as Council of Europe Convention 108. See, WP29, Adequacy Referential, WP 254 rev.01, 28 November 2017, p. 4 (available here).
- ↑ For example, a regulation based on voluntary commitment is not excluded from the outset. However, effective monitoring and control mechanisms will then have to be put in place in the third country to identify and punish in practice any breaches of rules guaranteeing the protection of fundamental rights, in particular the right to respect for privacy and the right to the protection of personal data. See, Zerdick, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 45 GDPR, margin number 6 (Beck 2018, 2nd ed.) (accessed 3 March 2022).
- ↑ Zerdick, in Ehmann, Selmayr, Datenschutz-Grundverordnung, Article 45 GDPR, margin number 7 (Beck 2018, 2nd ed.) (accessed 3 March 2022).
- ↑ WP29, Adequacy Referential, WP 254 rev.01, 28 November 2017, p. 9 (available here).
- ↑ The clarification is probably made following the Snowden revelations on mass surveillance by the US government. See, WP29, Adequacy Referential, WP 254 rev.01, 28 November 2017, p. 9 (available here).
- ↑ Towfigh and Ulrich, in Sydow, Europäische Datenschutzgrundverordnung, Article 45 GDPR, margin number 11 (Beck 2018, 2nd ed.) (accessed 3 March 2022).
- ↑ Towfigh and Ulrich, in Sydow, Europäische Datenschutzgrundverordnung, Article 45 GDPR, margin number 13 (Beck 2018, 2nd ed.) (accessed 3 March 2022) who mentions the OECD Privacy Framework (available here).
- ↑ The fundamental different ideas on the protection of personal data among the different states, in combination with the economic policy and entrepreneurial freedoms promoted by the EU, leave space for adaptation for the third countries. It must also be noted that, an adequacy decision cannot regulate the exchange of data for the purpose of national security or the common foreign and security policy. See, European Commission, Decision on on the adequate protection of personal data contained in the Passenger Name Record of air passengers transferred to the United States, 2004/535/EG, 14 May 2004, repealed by the CJEU, Parliament v Council, C-317/04 and C-318/04, 30 May 2006 (available here); see Philipp, Öffentlichkeit bei Ratsentscheidungen gefordert, in EuZW, Volume 17 (2006), p. 357.
- ↑ WP29, Adequacy Referential, WP 254 rev.01, 28 November 2017, pp. 5-6 (available here).
- ↑ Or a territory or one or more specified sectors within a third country, or an international organisation.
- ↑ This is intended to force the Commission to regularly review its adequacy decisions and to counter possible changes in the data protection situation in a third country, for example through legislative changes. See, Towfigh and Ulrich, in Sydow, Europäische Datenschutzgrundverordnung, Article 45 GDPR, margin number 19 (Beck 2018, 2nd ed.) (accessed 3 March 2022)
- ↑ Data Protection Commission, Transfers of Personal Data to Third Countries or International Organisations (accessed on 19 August 2021, available here).
- ↑ Office Of The Data Protection Ombudsman, Transfers on the basis of an adequacy decision (accessed on 19 August 2021, available here).
- ↑ Zerdick, in Ehman, Selmayr, Datenschutz-Grundverordnung, Article 35 GDPR, margin number 22 (Beck 2018, 2nd ed.) (accessed 3 March 2022).
- ↑ The absence of a retroactive effect departures from EU law and avoids the disappearance of an EU act from the legal order from the date of entering into force (ex tunc). See, Lenaerts, Maselis,Gutman, EU Procedural Law, locations 18058 -18065 (Oxford University Press 2014).
- ↑ Towfigh and Ulrich, in Sydow, Europäische Datenschutzgrundverordnung, Article 45 GDPR, margin number 21 (Beck 2018, 2nd ed.) (accessed 3 March 2022)
- ↑ Kuner, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 45 GDPR, p. 789 (Oxford University Press 2020).
- ↑ Previous adequacy decisions of the Commission available here.
