Until this summer, the European Economic Area (EEA) had taken a simple three-prong approach to allowing personal data to be transferred to (or accessed from) countries outside the EEA – called third countries. These approaches are adequacy decisions, the use of safeguards, or derogations.
Adequacy decisions – a decision by the European Commission that the safeguards in a third country are essentially the same as those in the EEA. This required an extensive assessment of that country’s legislation, considerations by the European Data Protection Board (EDPB) and national regulators, negotiations on possible additional safeguards, and eventually a determination that an essentially equivalent level of data protection would be offered. Once an adequacy decision is made, data can flow freely without further formalities. Only twelve countries currently have an adequacy determination.
Transfers on the basis of appropriate safeguards, generally captured in contracts or formal documents. These transfers include the use of standard contractual clauses (SCCs), ad hoc contractual agreements subject to approval by the supervisory authority, as well as binding corporate rules (BCRs), certifications and codes of conduct.
If neither of the two above apply, then personal data may be transferred using specific derogations, including consent. The use of derogations is bound to strict rules, and can not be used for any massive, continuous or structural data transfers.
The three tiers seemed to imply that the lower the administrative burden on the data controller to start a data transfer would be, the higher the initial assessment threshold should be. Clearly, the level of protection of natural persons guaranteed by the General Data Protection Regulation (GDPR) shall not be undermined (Article 44 GDPR).
In the Schrems II decision in July, the Court of Justice of the Europe ..
Support the originator by clicking the read the rest link below.
