College Notes Privacy - Week 5

Transfers of Data
Personal data transfers legal provision
 General Data Protection Regulation
- Recital 170
- Article 1(3)
- Article 44
- Article 46
- Article 47
- Article 49
 International agreements

Free flow of personal data between EU Member States
 Article 1(3)
 The flow of personal data throughout the EU must be free from restrictions
 Free data flow: Iceland, Liechtenstein and Norway

Personal data transfers to third countries or to international organisations
In principe, two ways to allowing transfer of personal data to third countries or to
international organizations:
 Adequacy decision: art. 45 GDPR
 Appropriate safeguards: art. 46 GDPR

Transfers based on an adequacy decision
Art. 45 GDPR
What is required?
 ‘’adequate level of protection’’  ‘’essentially equivalent’’ (C-362/14 Schrems, para.
96)
 The adequacy standard does not require a point-to-point replication of EU rules
Who determines the adequacy?
 The European Commission
o But recall Week 2: national supervisory authorities have the competence to
examine the claim of a person concerning the protection of their personal
data which has been transferred to a third country that has been deemed by
the Commission as ensuring an adequate level of protection, where that
person contends that the law and practices in force in the third country do
not ensure an adequate level of protection (C-362/14 Schrems, para. 63, 65,
66)
How is the adequacy determined?