Privacy & Information Security Law Blog

On May 30, 2018, the European Data Protection Board (“EDPB”), replacing the Article 29 Working Party, published the final version of Guidelines 2/2018 on derogations in the context of international data transfers and draft Guidelines 1/2018 on certification under the EU General Data Protection Regulation (“GDPR”). 

What are the Guidelines about?

Guidelines on Derogations

Derogations under Article 49 of the GDPR are exemptions from the general principle that personal data may only be transferred to countries outside of the European Economic Area (“EEA”) or to an international organization if an adequate level of data protection is provided for in that country or by that international organization, or if appropriate safeguards have been adduced and data subjects enjoy enforceable and effective rights to ensure that the level of protection guaranteed by the GDPR is not undermined.

The Guidelines provide clarification to the following derogations:

• The data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards (Article 49 (1)(a)). In particular, the Guidelines focus on the specific elements required for consent to be considered a valid legal ground for international data transfers to third countries and international organizations.
• The transfer is necessary for the performance of a contract between the data subject and data controller, or for the implementation of pre-contractual measures taken at the data subject’s request (Article 49 (1)(b)).
• The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller and another natural or legal person (Article 49 (1)(c)).
• The transfer is necessary for important reasons of public interest (Article 49 (1)(d)).
• The transfer is necessary for the establishment, exercise or defense of legal claims (Article 49 (1)(e)).
• The transfer is necessary in order to protect the vital interests of data subjects or other persons (Article 49 (1)(f)).
• The transfer is made from a public register (Article 49 (1)(g) and (2)).
• The transfer is necessary for the purposes of compelling legitimate interests pursued by the data exporter that are not overridden by the interests or rights and freedoms of the data subjects (Article 49(1) and (2)).

The Guidelines note that personal data may only be transferred under these derogations if the transfer is occasional and not repetitive (i.e., the transfer “may happen more than once, but not regularly,” and may occur “under random, unknown circumstances and within arbitrary time intervals”). Derogations may therefore not be used to legitimize data transfers where, for example, the data importer is granted direct access to a database on a general basis. The Guidelines also stress the importance of conducting a necessity test to assess the possible use of most of the above derogations. This necessity test requires an evaluation by the EU/EEA data exporter on whether a transfer of personal data can be considered necessary for the specific purpose of the derogation to be used. Finally, the Guidelines note that a transfer in response to a decision from a non-EEA authority is only lawful if that transfer complies with the data transfer rules of the GDPR. In particular, where there is an international agreement (e.g., a mutual legal assistance treaty (“MLAT”)), the EDPB recommends that EU companies should generally refuse direct requests and refer the requesting non-EEA authority to the existing MLAT or agreement.

Guidelines on Certification

Certification mechanisms are accountability tools that companies may choose to implement to demonstrate compliance with the GDPR. The Guidelines on certification aim to identify overarching criteria that may be relevant to all types of certification mechanisms issued in accordance with the GDPR, thereby helping EU Member States, supervisory authorities and national accreditation bodies establish a more consistent, harmonized approach for the implementation of certification mechanisms.

The Guidelines on certification consist of 6 core sections:

• Section 1 explains the purpose of certification and the key concepts of the certification provisions in the GDPR.
• Sections 2 and 3 explore the role of the EU supervisory authorities and certification bodies that may issue certification.
• Section 4 discusses the approval of certification criteria by the competent EU supervisory authority as well as the approval of certification criteria by the EDPB that may result in a European Data Protection Seal requirements, which would prevent fragmentation amongst data protection certification.
• Section 5 highlights what can be certified under the GDPR and the documentation aspects to ensure it is clearly recorded including assessment and results.
• Section 6 provides guidance for defining certification criteria.

The EDPB is accepting comments on the Guidelines on certification until July 12, 2018. The EDPB will publish separate guidelines to address the identification of criteria to approve certification mechanisms as data transfer tools to third countries or international organizations.