EDRi’s proposed new Article
Article -33 – Transfers to recipients not subject to the provisions implementing this Directive
Member States shall provide that transfers of personal data by competent authorities to recipients that are not subject to the provisions implementing this Directive may only take place if such transfers are:
(a) provided for in national law; such laws must be in compliance with the Charter of Fundamental Rights of the European Union and the Convention for the Protection of Human Rights and Fundamental Freedoms, and be in line with the case law of the Court of Justice of the European Union and the European Court of Human Rights; or
(b) necessary for the protection of the vital interests of the data subject or another person; or
(c) carried out upon request of the data subject.
The Commission proposal does not contain specific guarantees for transfers of personal data to private parties and non-law-enforcement public authorities. Yet, according to Principle 5 of Council of Europe Recommendation No R(87)15, such transfers should only be permissible under specific and strict conditions. While this Recommendation is not binding on Member States, implementing it is good practice. Also, there is absolutely no reason why EU rules in this area should fall behind the Council of Europe’s framework. To this end, this proposed new Article adds specific provisions on such transfers, taking inspiration from the above-mentioned Council of Europe Recommendation.
This change would also require a slight reorganisation of the chapters of the Directive. Chapter V should begin with this Article and should be titled “Chapter V – Transfer of personal data” with a “section 1 – Transfer to recipients in the Union not subject to the provisions implementing this Directive” containing this Article and a section two with the current title of the whole Chapter V.