Guidelines on Article 48 GDPR (transfers or disclosures not authorised by Union law)

The European Data Protection Board published the Guidelines 02/2024 on Article 48 GDPR about transfers or disclosures not authorised by Union law.

Αs mentioned in the introduction to the guidelines, "article 48 GDPR provides that: “Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter”. 

The purpose of these guidelines is to clarify the rationale and objective of this article, including its interaction with the other provisions of Chapter V of the GDPR, and to provide practical recommendations for controllers and processors in the EU that may receive requests from third country authorities to disclose or transfer personal data. The main objective of the provision is to clarify that judgments or decisions from third country authorities cannot automatically and directly be recognised or enforced in an EU Member State, thus underlining the legal sovereignty vis-a-vis third country law. 

As a general rule, recognition and enforceability of foreign judgements and decisions is ensured by applicable international agreements. Regardless of whether an applicable international agreement exists, if a controller or processor in the EU receives and answers a request from a third country authority for personal data, such data flow is a transfer under the GDPR and must comply with Article 6 and the provisions of Chapter V. 

An international agreement may provide for both a legal basis (under Article 6(1)(c) or 6(1)(e)) and a ground for transfer (under Article 46(2)(a)). In the absence of an international agreement, or if the agreement does not provide for a legal basis under Article 6(1)(c) or 6(1)(e), other legal bases could be considered. Similarly, if there is no international agreement or the agreement does not provide for appropriate safeguards under Article 46(2)(a), other grounds for transfer could apply, including the derogations in Article 49". (source: edpb.europa.eu/photo freepik.com)

Read the Guidelines here

Comments

Post a Comment

Popular posts from this blog

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Access to documents: the Commission decision refusing a journalist of The New York Times access to the text messages exchanged between President von der Leyen and the CEO of Pfizer is annulled (CJEU)

Image
In its Judgment dated 14/5/2025 in Case T-36/23 (Stevi and The New York Times v Commission), the General Court ruled that the Commission decision refusing a journalist of The New York Times access to the text messages exchanged between President von der Leyen and the CEO of Pfizer is annulled. By an application based on the Access to Documents Regulation, [1], Matina Stevi, a journalist working for the daily newspaper The New York Times, requested the European Commission to provide access to all text messages exchanged between President Ursula von der Leyen and Albert Bourla, the chief executive officer of Pfizer, between 1 January 2021 and 11 May 2022.  The Commission rejected that application on the ground that it did not hold the documents covered by it. Ms Stevi and The New York Times requested the General Court of the European Union to annul the Commission’s decision.  In its judgment, the General Court upholds the action and annuls the Commission’s decision. The Court re...
Read more

An overview of the regulatory framework on Gambling Services in the European Union

Image
written by Efi Thoma * The European Union (EU) does not have a harmonized, single regulatory framework for betting companies. Instead, the regulation of gambling services, including betting, remains largely within the competence of individual Member States.  This results in a diverse and often fragmented legal framework across the EU. While the EU facilitates some level of cooperation and sets overarching principles, the specifics of licensing, operational requirements, and consumer protection measures vary significantly from country to country. Despite the lack of a unified framework, several key principles and EU-level instruments influence the national regulations of betting companies. More specifically, the Treaty on the Functioning of the European Union (TFEU) guarantees the freedom of establishment and the freedom to provide services within the EU. These fundamental freedoms mean that Member States cannot unjustifiably restrict betting companies legally established in ano...
Read more

New President of the European Court of Human Rights

Image
The European Court of Human Rights has elected on 28.4.2025 Mattias Guyomar, Judge elected in respect of France, as its new President.  Mattias Guyomar succeeds Marko Bošnjak, Judge elected in respect of Slovenia. He will take up office on 30 May 2025. Read his bio here Furthermore, the Judge elected in respect of Armenia, Vahe Grigoryan, was formally sworn in in the Court's Main Hearing Room on 28.4.2025. Read as well:  Interventions in Justice System and the role of Artificial Intelligence / article by Giorgos Kazoleas, Lawyer in Cyprus
Read more

Imposition of a fine on a bank in Greece for an incident of personal data breach

Image
The Greek Data Protection Supervisory Authority imposed on a Bank, as Data Controller, an administrative fine of EUR 100,000 for violating the principles of accuracy, integrity, and confidentiality of data, and the principles of data protection by design and by default, in conjunction with Articles 32, 33, and 34 of the GDPR, as well as an administrative fine of EUR 20,000 for violating the complainants' right of access. Complaints were submitted to the Supervisory Authority of Greece against the National Bank of Greece for the incorrect linking of a complainant's bank account with the mobile phone number of another complainant in the “i-bank Pay application”, which resulted in money transfers, via “IRIS online payments service”, which were made to the first complainant's account instead of the second's.  In the context of the administrative audit conducted by the Authority, the Bank eventually identified that the issue was due to incorrect configuration during the ...
Read more