The Article 29 Working Party has established the Draft guidelines on Art. 49 GDPR submitted. Interested parties have until March 26, 2018 to submit their comments.
Art. 49 GDPR allows the disclosure of personal data to a third country in certain exceptional cases, including with the explicit consent of the data subjects, for the performance or preparation of a contract, or for other reasons. In it, the Art. 29 Working Party proposes the following guidelines, among others:
-
- The exemption provisions of Art. 49 GDPR are as follows Generally restrictive to be laid out and can Only in individual cases be called;
- Art. 49 GDPR cannot be invoked to override Art. 48 GDPR. Data transfers based on a Mutual Legal Assistance Convention (Mutual Legal Assistance Treaty, MLAT) should therefore not be legitimized by Art. 49 GDPR;
- consent to the transfer of personal data to third countries is only effective if it is given expressly and is specific to the data transmission the consenting person must also have the following Sufficiently informed be made, including on the following points:
- the concrete Risksassociated with the disclosure, such as that processing principles do not apply or that no supervisory authority exists (as the case may be; however, these notices can be explicitly standardized, so they do not have to be adapted to each individual case);
- the Receiver,
- the Beneficiary States,
- the fact that the transmission is carried out on the Consent should be based,
- the fact that for the recipient states a Adequacy Finding missing.
- during transmission to the Contract fulfillment or initiation a strict standard is applied. The transfer to other Group companies for shared services in the HR area, for example, cannot be based on this fact;
- the transmission for important reasons of the öffentlichen Interesses is not possible simply because a foreign authority is conducting an investigation in the public interest. Rather, it is necessary that also the transmission to the investigating foreign authority is in the public interest of the EU or a Member State; reciprocity considerations must also be taken into account (cf. here);
- the transmission is necessary for the assertion, exercise or defense of Rechtsansprüchen includes, among other things, the transmission in connection with criminal or administrative proceedings, including, for example, in the context of pre-trial discovery or for trial preparation, as long as the corresponding proceedings are not merely a theoretical possibility. However, only the data necessary for the relevant purposes is permissible in each case.