Article 41*
Article 41 – Transfers with an adequacy decision
Commission Proposal
1. A transfer may take place where the Commission has decided that the third country, or a territory or a processing sector within that third country, or the international organisation in question ensures an adequate level of protection. Such transfer shall not require any further authorisation.2. When assessing the adequacy of the level of protection, the Commission shall give consideration to the following elements:
(a) the rule of law, relevant legislation in force, both general and sectoral, including concerning public security, defence, national security and criminal law, the professional rules and security measures which are complied with in that country or by that international organisation, as well as effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred; 3. The Commission may decide that a third country, or a territory or a processing sector within that third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2). 4. The implementing act shall specify its geographical and sectoral application, and, where applicable, identify the supervisory authority mentioned in point (b) of paragraph 2. 5. The Commission may decide that a third country, or a territory or a processing sector within that third country, or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, in particular in cases where the relevant legislation, both general and sectoral, in force in the third country or international organisation, does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2), or, in cases of extreme urgency for individuals with respect to their right to personal data protection, in accordance with the procedure referred to in Article 87(3). 6. Where the Commission decides pursuant to paragraph 5, any transfer of personal 7. The Commission shall publish in the Official Journal of the European Union a list of 8. Decisions adopted by the Commission on the basis of Article 25(6) or Article 26(4) |
EDRi’s proposed amendment
1. A transfer may take place where the Commission has decided that the third country, or a territory or a processing sector within that third country, or the international organisation in question ensures an adequate level of protection. Such transfer shall not require any further authorisation. Such decisions shall not affect the level of protection under this Regulation.2. When assessing the adequacy of the level of protection, the Commission shall give consideration to the following elements:
(a) the rule of law, relevant legislation in force, both general and sectoral, including concerning public security, defence, national security and criminal law, as well as the implementation of this legislation, the professional rules and security measures which are complied with in that country or by that international organisation, as well as effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred; 2a. The Commission shall request the European Data Protection Board to provide an opinion on the adequacy of the level of protection. To this end, the Commission shall provide the European Data Protection Board with all necessary documentation, including correspondence with the government of the third country or the international organisation. 3. The Commission may decide that a third country, or a territory or a processing sector within that third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2, taking the opinion of the European Data Protection Board into utmost account. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2). 4. The implementing act shall specify its geographical and sectoral application, and, where applicable, identify the supervisory authority mentioned in point (b) of paragraph 2. 4a. The Commission shall, on an ongoing basis, monitor developments that could affect the fulfilment of the elements listed in paragraph 2 in third countries and international organisations concerning which a decision pursuant to paragraph 3 has been adopted. 4b. If the Commission has grounds to believe, either because of the monitoring pursuant to paragraph 4a or any other source, that a country or international organisation concerning which a decision pursuant to paragraph 3 has been adopted no longer provides an adequate level of protection within the meaning of paragraph 2, it shall review this decision. 5. The Commission may decide that a third country, or a territory or a processing sector within that third country, or an international organisation does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, in particular in cases where the relevant legislation, both general and sectoral, in force in the third country or international organisation, does not guarantee effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2), or, in cases of extreme urgency for individuals with respect to their right to personal data protection, in accordance with the procedure referred to in Article 87(3). 6. Where the Commission decides pursuant to paragraph 5, any transfer of personal data to the third country, or a territory or a processing sector within that third country, or the international organisation in question shall be prohibited, 7. The Commission shall publish in the Official Journal of the European Union a list of those third countries, territories and processing sectors within a third country and international organisations where it has decided that an adequate level of protection is or is not ensured. 8. Decisions adopted by the Commission on the basis of Article 25(6) or Article 26(4) of Directive 95/46/EC shall remain in force, until amended, replaced or repealed by the Commission. |
Justification
When assessing the adequacy of protection in a third country or international organisation, the analysis must not be restricted to the “law on the books”, as legislation may be improperly implemented. Therefore, it is suggested to include a specific requirement to evaluate the implementation of the legislation as well. Given the sensitivity of adequacy decisions, it is advisable to provide a role for the European Data Protection Board, since its expertise can contribute to the quality of such decisions. The Commission shall then take this decision into utmost account. It should be noted that already under the current framework, the Article 29 Working Party adopts opinions on the adequate level of protection in third countries. After an adequacy decision has been adopted, it is possible that the legislation in force or its implementation in a third country or international organisation deteriorates to the point that adequacy is no longer guaranteed. For this reason, it is wise to mandate the Commission to continually monitor developments in third countries that could affect the level of protection and to reassess the decision if needed.
In the case of a non-adequacy decision, the possibilities for transfers should be further restricted, in line with the EDPS opinion.