Article 35 – Transfers by way of appropriate safeguards
|1. Where the Commission has taken no decision pursuant to Article 34, Member States shall provide that a transfer of personal data to a recipient in a third country or an international organisation may take place where:
(a) appropriate safeguards with respect to the protection of personal data have been adduced in a legally binding instrument; or
(b) the controller or processor has assessed all the circumstances surrounding the transfer of personal data and concludes that appropriate safeguards exist with respect to the protection of personal data.
2. The decision for transfers under paragraph 1 (b) must be made by duly authorised staff. These transfers must be documented and the documentation must be made available to the supervisory authority on request.
EDRi’s proposed amendment
|1. Where the Commission has taken no decision pursuant to Article 34, Member States shall provide that a transfer of personal data to a
A self-assessment of the controller or processor cannot be a basis for such transfers, especially given that the controllers own interests might influence its judgment as to whether the safeguards are appropriate. Such transfers should always be based on a legally binding instrument. See also pt. 415 of the EDPS opinion.