28
Thu, Mar
51 New Articles

Derogations Applicable in Relation to Personal Data Transfer to Third Countries or International Organisations

Derogations Applicable in Relation to Personal Data Transfer to Third Countries or International Organisations

Romania
Tools
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

According to Art. 44 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), ˝Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organization shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organization to another third country or to another international organization

Therefore, a transfer of personal data to a third country or an international organisation is allowed where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection or, in the absence of an adequacy decision, where the transfer takes place based on the appropriate safeguards provided by the controller or the processor and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.

These mechanisms for transfer represent the rule. There are however certain derogatory situations that are exceptions from the general principle laid down above and will only apply in the absence of an adequacy decision or appropriate safeguards. These situations are:

  1. the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;
  2. the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request;
  3. the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;
  4. the transfer is necessary for important reasons of public interest;
  5. the transfer is necessary for the establishment, exercise or defence of legal claims;
  6. the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;
  7. the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case.

The first derogatory situation requires that the data subject should explicitly consent to the proposed transfer. In order for the consent of the data subject to be valid, it should be explicit, specific for a certain transfer or set of transfers of personal data, and informed, particularly as to the possible risks of the transfer. A valid consent so that the transfer can made needs to be given at the time when the transfer is going to be made not at the time when the data are collected. Furthermore, the data subject should be informed of the possible risks entailed by the absence of an adequate level of protection in the third country where the transfer is to be made and the absence of the appropriate safeguards. According to Guidelines 2/2018 on derogations of Article 49 under Regulation (EU) 2016/679 adopted on 25 May 2018 by the European Data Protection Board, the notice in question ˝(…) should include for example information that in the third country there might not be a supervisory authority and/or data processing principles and/or data subject rights might not be provided for in the third country

The second derogatory situation requires that the transfer should be necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request. For such a transfer to be legitimate, there should be a close and substantial connection between the data transfer and the purposes of the contract whose performance is sought and the transfer should be occasional in nature. A transfer of data may be deemed to be occasional in nature for example in the case that the personal data of a sales manager, who in the context of his/her employment contract has to travel to different clients located in third countries, are to be sent to those clients in order to arrange the meetings.

Another derogation refers to the case where the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person. It has to be noted that, in order for this derogation to apply, the transfer has to be occasional and necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person. For instance, where an organization has, for business purposes, outsourced activities such as payroll management to service providers outside the EU, this derogation will not provide a basis for data transfers for such purposes, since no close and substantial link between the transfer and a contract concluded in the data subject’s interest can be established, even if the end purpose of the transfer is the management of the pay of the employee.

The fourth derogatory situation regulates the necessity of the transfer for important reasons of public interest. A public interest that is not based on EU or Member State law or is only provided by the law of a third country is not a legal basis for data transfers based on important reasons of public interest. According to recital 112 of Regulation (EU) 2016/679, this derogation should in particular apply to data transfers that are required and necessary for important reasons of public interest, for example in cases of international data exchange between competition authorities, tax or customs administrations, between financial supervisory authorities, between services competent for social security matters, or for public health, for example in the case of contact tracing for contagious diseases or in order to reduce and/or eliminate doping in sport.

Another derogatory situation takes into consideration the necessity of the transfer for the establishment, exercise or defense of legal claims. As far as this derogation is concerned, it should be pointed out that, according to the same Guidelines issued by the European Data Protection Board, ˝(...) a close link is necessary between a data transfer and a specific procedure regarding the situation in question

The category of derogations also includes a transfer that is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent. This derogation implies that the data subject is physically or legally incapable of giving consent, in which case the requirements of Regulation (EU) 2016/679 regarding the form that the consent should take are no longer met. Consequently, if the data subject is capable of giving consent, this derogation does not apply.

Regulation (EU) 2016/679 also includes, in the category of derogatory situations, a transfer that is made from a register which, according to Union or Member State law, is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case. This derogation only refers to the registers intended to provide information to the public, therefore private registers are outside of the scope of this derogation. In this respect, Guidelines 2/2018 on derogations of Article 49 under Regulation (EU) 2016/679 provide the example of the private registers through which credit-worthiness is appraised.

Another derogation that may be taken into consideration in the event that the transfer cannot be based on an adequacy decision or cannot take place based on the appropriate safeguards provided by the controller or the processor, or none of the derogations described above is applicable, regards the situation where a transfer to a third country or an international organization may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data.

According to Regulation (EU) 2016/679, this type of transfers should be possible only in residual cases where none of the other grounds for transfer are applicable, being conditional on the fulfilment of a significant number of conditions.

In order to summarize, it should be said that whenever a transfer of personal data is intended to be made to third countries or international organisations, the controller or the processor should favor the mechanisms for transfer that provide data subjects with a guarantee that they will continue to benefit from the fundamental rights and the safeguards that are required in the processing of their data.

By Anca Stinga, Attorney at Law, Popescu & Asociatii

Romanian Knowledge Partner

Țuca Zbârcea & Asociații is a full-service independent law firm, employing cross-disciplinary teams of lawyers, insolvency practitioners, tax consultants, IP counsellors, economists and staff members. It also operates a secondary law office in Cluj-Napoca (Romania), and has a ‘best-friend’ agreement with a leading law firm in the Republic of Moldova. In addition, thanks to the firm’s dedicated Foreign Desks, the team provides the full range of services to international investors seeking to gain a foothold or expand their existing operations in Romania. Since 2019, the firm and its tax arm are collaborating with Andersen Global in Romania.

Țuca Zbârcea & Asociaţii is providing legal services in every aspect of business, covering all major areas of practice: corporate and M&A; litigation and international arbitration; corporate tax; public procurement; TMT; employment; insurance; banking and finance; capital markets; competition; healthcare and pharmaceutical; energy and natural resources; environmental; intellectual property; real estate; regulatory legal services.

Țuca Zbârcea & Asociaţii is a First-Tier law firm in all international legal directories and a multiple award-winning law firm both locally and internationally. It received the CEE Deal of the Year Award (DOTY Awards 2021) and the Law Firm of the Year Award: Romania (IFLR Europe Awards 2021). 

Firm's website.

Our Latest Issue