Article 41*

Article 41 – Transfers with an adequacy decision

Commission Proposal

Go down to proposed amendment

1. A transfer may take place where the Commission has decided that the third country, or a territory or a processing sector within that third country, or the international organisation in question ensures an adequate level of protection. Such transfer shall not require any further authorisation.2. When assessing the adequacy of the level of protection, the Commission shall give consideration to the following elements:

(a) the rule of law, relevant legislation in force, both general and sectoral, including concerning public security, defence, national security and criminal law, the professional rules and security measures which are complied with in that country or by that international organisation, as well as effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred;
(b) the existence and effective functioning of one or more independent supervisory authorities in the third country or international organisation in question responsible for ensuring compliance with the data protection rules, for assisting and advising the data subjects in exercising their rights and for co-operation with the supervisory authorities of the Union and of Member States; and
(c) the international commitments the third country or international organisation in question has entered into.

3. The Commission may decide that a third country, or a territory or a processing sector within that third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).

4. The implementing act shall specify its geographical and sectoral application, and, where applicable, identify the supervisory authority mentioned in point (b) of paragraph 2.

5. The Commission may decide that a third country, or a territory or a processing sector within that third country, or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, in particular in cases where the relevant legislation, both general and sectoral, in force in the third country or international organisation, does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2), or, in cases of extreme urgency for individuals with respect to their right to personal data protection, in accordance with the procedure referred to in Article 87(3).

6. Where the Commission decides pursuant to paragraph 5, any transfer of personal
data to the third country, or a territory or a processing sector within that third
country, or the international organisation in question shall be prohibited, without
prejudice to Articles 42 to 44. At the appropriate time, the Commission shall enter
into consultations with the third country or international organisation with a view to
remedying the situation resulting from the Decision made pursuant to paragraph 5 of
this Article.

7. The Commission shall publish in the Official Journal of the European Union a list of
those third countries, territories and processing sectors within a third country and
international organisations where it has decided that an adequate level of protection
is or is not ensured.

8. Decisions adopted by the Commission on the basis of Article 25(6) or Article 26(4)
of Directive 95/46/EC shall remain in force, until amended, replaced or repealed by
the Commission.

Go to related Recital 79.

Go to related Recital 80

Go to related Recital 81

Go to related Recital 82

Go to related Recital 83

Go to related Recital 89


EDRi’s proposed amendment

1. A transfer may take place where the Commission has decided that the third country, or a territory or a processing sector within that third country, or the international organisation in question ensures an adequate level of protection. Such transfer shall not require any further authorisation. Such decisions shall not affect the level of protection under this Regulation.2. When assessing the adequacy of the level of protection, the Commission shall give consideration to the following elements:

(a) the rule of law, relevant legislation in force, both general and sectoral, including concerning public security, defence, national security and criminal law, as well as the implementation of this legislation, the professional rules and security measures which are complied with in that country or by that international organisation, as well as effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred;
(b) the existence and effective functioning of one or more independent supervisory authorities in the third country or international organisation in question responsible for ensuring compliance with the data protection rules, for assisting and advising the data subjects in exercising their rights and for co-operation with the supervisory authorities of the Union and of Member States; and
(c) the international commitments the third country or international organisation in question has entered into.

2a. The Commission shall request the European Data Protection Board to provide an opinion on the adequacy of the level of protection. To this end, the Commission shall provide the European Data Protection Board with all necessary documentation, including correspondence with the government of the third country or the international organisation.

3. The Commission may decide that a third country, or a territory or a processing sector within that third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2, taking the opinion of the European Data Protection Board into utmost account. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).

4. The implementing act shall specify its geographical and sectoral application, and, where applicable, identify the supervisory authority mentioned in point (b) of paragraph 2.

4a. The Commission shall, on an ongoing basis, monitor developments that could affect the fulfilment of the elements listed in paragraph 2 in third countries and international organisations concerning which a decision pursuant to paragraph 3 has been adopted.

4b. If the Commission has grounds to believe, either because of the monitoring pursuant to paragraph 4a or any other source, that a country or international organisation concerning which a decision pursuant to paragraph 3 has been adopted no longer provides an adequate level of protection within the meaning of paragraph 2, it shall review this decision.

5. The Commission may decide that a third country, or a territory or a processing sector within that third country, or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, in particular in cases where the relevant legislation, both general and sectoral, in force in the third country or international organisation, does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2), or, in cases of extreme urgency for individuals with respect to their right to personal data protection, in accordance with the procedure referred to in Article 87(3).

6. Where the Commission decides pursuant to paragraph 5, any transfer of personal data to the third country, or a territory or a processing sector within that third country, or the international organisation in question shall be prohibited, without prejudiceĀ unless it is subject to adequate safeguards pursuant to Articles 42 or falls under the derogatios in Article to 44. At the appropriate time, the Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation resulting from the Decision made pursuant to paragraph 5 of this Article.

7. The Commission shall publish in the Official Journal of the European Union a list of those third countries, territories and processing sectors within a third country and international organisations where it has decided that an adequate level of protection is or is not ensured.

8. Decisions adopted by the Commission on the basis of Article 25(6) or Article 26(4) of Directive 95/46/EC shall remain in force, until amended, replaced or repealed by the Commission.

Justification

When assessing the adequacy of protection in a third country or international organisation, the analysis must not be restricted to the “law on the books”, as legislation may be improperly implemented. Therefore, it is suggested to include a specific requirement to evaluate the implementation of the legislation as well. Given the sensitivity of adequacy decisions, it is advisable to provide a role for the European Data Protection Board, since its expertise can contribute to the quality of such decisions. The Commission shall then take this decision into utmost account. It should be noted that already under the current framework, the Article 29 Working Party adopts opinions on the adequate level of protection in third countries. After an adequacy decision has been adopted, it is possible that the legislation in force or its implementation in a third country or international organisation deteriorates to the point that adequacy is no longer guaranteed. For this reason, it is wise to mandate the Commission to continually monitor developments in third countries that could affect the level of protection and to reassess the decision if needed.

In the case of a non-adequacy decision, the possibilities for transfers should be further restricted, in line with the EDPS opinion.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

  • eu logo The launch and upkeep (until December 31, 2013) of this website received financial support from the EU's Fundamental Rights and Citizenship Programme.
%d bloggers like this: