Recital 49*

Commission Proposal

49. Transfers not based on such an adequacy decision should only be allowed where appropriate safeguards have been adduced in a legally binding instrument, which ensure the protection of the personal data or where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and, based on this assessment, considers that appropriate safeguards with respect to the protection of personal data exist. In cases where no grounds for allowing a transfer exist, derogations should be allowed if necessary in order to protect the vital interests of the data subject or another person, or to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides, or where it is essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country, or in individual cases for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, or in individual cases for the establishment, exercise or defence of legal claims.

EDRi’s proposed amendment

49. Transfers not based on such an adequacy decision should only be allowed where appropriate safeguards have been adduced in a legally binding instrument, which ensure the protection of the personal data or where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and, based on this assessment, considers that appropriate safeguards with respect to the protection of personal data exist. In cases where no grounds for allowing a transfer exist, derogations should be allowed if necessary in order to protect the vital interests of the data subject or another person, or to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides, or where it is essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country, or in individual cases for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, or in individual cases for the establishment, exercise or defence of legal claims. Where the Commission has issued a negative adequacy decision, the use of derogations should be restricted to cases where the transfer is necessary in order to protect the vital interests of the data subject or another person or where it is essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country. In any case, these derogations should be interpreted restrictively. In particular, derogations should not be used to allow frequent, massive, or structural transfers. Also when transferring data on individual cases, the amount of data should be limited to what is strictly necessary. Additionally, any transfer based on a derogation should be comprehensively documented. This documentation should be made available to the supervisory authority on request.

Justification

This amendment mirrors the proposed changes to Article 36. If there is a negative adequacy decision, the use of derogations should be restricted further. Whenever derogations are used, they should be interpreted restrictively, as called for by the EDPS. In any case, transfers based on derogations should be documented.

  • eu logo The launch and upkeep (until December 31, 2012) of this website received financial support from the EU's Fundamental Rights and Citizenship Programme.
Follow

Get every new post delivered to your Inbox.

%d bloggers like this: