During its first plenary meeting, the EDPB adopted the final version of the Guidelines on derogations applicable to international transfers (Art. 49) (available here). Its predecessor, the Article 29 Working Party conducted a public consultation on a draft of these guidelines. The EDPB took into consideration the replies received and integrated the appropriate changes into the adopted version.
Derogations under Article 49 of the GDPR are exemptions from the general principle that personal data may only be transferred to countries outside of the European Economic Area or to an international organization if an adequate level of data protection is provided for in that country or by that international organization, or if appropriate safeguards have been adduced and data subjects enjoy enforceable and effective rights to ensure that the level of protection guaranteed by the GDPR is not undermined.
The EDPB Guidelines provide helpful practical guidance and should be consulted when looking to rely on any of the Art. 49 derogations. In a nutshell, they:
- clarify that the derogations must be interpreted restrictively and that data exporters should always favor other solutions that do provide adequate protection or appropriate safeguards for the data transferred (such as binding corporate rules or standard data protection clauses), so that relying on derogations does not become the rule
- explain that the concepts of “occasional” and “non-repetitive” transfers capture transfers that happen more than once outside the regular course of action (e.g., under random, unknown circumstances and within arbitrary time intervals) but they do not capture regular transfers within established relationships
- highlight the fact that even derogations which are not expressly limited to “occasional” or “not repetitive” transfers have to be treated as narrow exceptions from the general rule that personal data may not be transferred to a third country unless the country provides for an adequate level of data protection or, alternatively, appropriate safeguards are put in place
- reiterate the fact that several derogations are subject to a necessity requirement and provides guidance on how the necessity test should be applied in practice
- provide detailed guidance on how each of the Article 49 derogations should be applied in practice.