PL EN
Book a meeting
Chapter 1Basic Compliance
  1. Chapter 1Basic Compliance
  2. Chapter 2Data Subject’s Rights
  3. Chapter 3Security
  4. Chapter 4Data Processing
  5. Chapter 5Managing Incidents and Data Breaches
  6. Chapter 6Data Protection Officer (DPO)
  7. Chapter 7The Regulator
  8. Chapter 8Legal Remedies, Liability, Administrative Sanctions
  9. Appendix IPersonal Data Protection Policy
  10. Appendix IIData Processing Agreement
  11. Appendix IIIJoint Controllership Agreement
Section 1.11
  1. 1.1The GDPR: The EU’s ‘Act’ on Personal Data Protection
  2. 1.2Material and Territorial Scope of the GDPR
  3. 1.3GDPR Glossary: Notes on Basic GDPR Terms, with Examples
  4. 1.4Personal Data Processing Principles
  5. 1.5Legal Basis for Personal Data Processing
  6. 1.6Articles 9 and 10 GDPR: Special Categories of Data and Data on Criminal Convictions
  7. 1.7Consent as Basis for Processing Personal Data
  8. 1.8The Controller and Processor
  9. 1.9Data Processing Which Does Not Require Identification
  10. 1.10Record of Data Processing Activities
  11. 1.11Transfer of Data to Third Countries or an International Organisation (Data Export)
  12. 1.12Cross-Border Processing, i.e. Competence of the Lead Supervisory Authority (Article 4(16) and (23), Article 56 GDPR)
  13. 1.13Joint Controllers
  14. 1.14Codes of Conduct and Certification (Article 40 Onwards of the GDPR)

Transfer of Data to Third Countries or an International Organisation (Data Export)

Katarzyna Kloc, Maciej Gawronski, Marcin Dominiak, Michał Sztaberek, Patrycja Naklicka & Paweł Punda

#11.1 Regulation of Data Export

Under Article 44 GDPR, transfer of personal data to outside of the EEA (EU and Norway, Iceland, and Liechtenstein), known as ‘data export’, is only permitted if a level of protection is assured equal to that required under the GDPR, including specific provisions in Chapter V of the GDPR. It is not only transfer of data outside of the EEA that is considered data export. Transfer to an international organisation (the UN, Arab League, International Red Cross, etc.) is also data export.

Data can be moved freely within the EU and even with the EEA. The EU is even considering introducing additional regulations to this end. On the other hand, transfer of personal data outside of the EEA is regulated and will be regulated even further under the GDPR.

#11.2 Practical Obstacles to Data Export

The fundamental difference and true restriction in relation to the previous data export regulations cannot be found in Chapter V of the GDPR. A practical restriction is the obligation to inform the subjects whose data is to be exported, provided for under Article 13(1)(f) and Article (14)(1)(f) GDPR. At the same time, recipients of data outside of the EEA have to be listed in the RDPAs, but this is less of a burden than informing the individuals whose data is processed of the intention to send the data somewhere ‘unknown’. From this point of view, anyone who currently ‘legally’ exports data will have an unpleasant surprise when they realise that they have to start informing individuals that data are sent outside of the EEA. This surprise will be even more unpleasant when it frequently becomes clear that their processors or further engaged processors (subprocessors) export data.

#11.3 Lawfulness of Data Export

The requirements for permissibility of data export are extra in relation to the general requirements for the permissibility of data processing (legal grounds, notification, etc.).

#11.4 Grounds for Data Export

It is permitted to send data outside of the EEA in the following cases:

  1. 1)on the basis of a EC decision; under Article 45 GDPR, the Commission may decide that certain countries provide an adequate level of protection of personal data. On the day on which this article was written, at the top of the list in a search in Google for a ‘list of third countries that provide an adequate level of personal data protection’ was the website of the GIODO, http://www
  2. .giodo.gov.pl/163/id_art/1519/j/pl, listing nine countries: Andorra, Argentina, Australia, Guernsey, Israel, Jersey, Canada, and New Zealand, and with regard to self-certifying companies, the US;
  3. 2)data ‘subject to appropriate safeguards’, which means, under Article 46 GDPR, on the grounds of the following special legal instruments:
    1. a)a legal instrument between public authorities or bodies (e.g., an administrative agreement between an EU member authority and an authority in a non-EU country);
    2. b)binding corporate rules – agreements within a capital group (corporate group);
    3. c)standard data protection clauses – templates for contractual terms:
      • adopted by the EC – the most common method up to now (referred to as standard contractual clauses under the ‘old system’) and
      • adopted by a national supervisory authority and approved by the EC (one wonders whether it makes sense to make exceptions to the EC template if the EC has to approve the template anyway: if an exception is intended to tighten up a rule, it is better not to make use of it, and if it is intended to undermine it, it should not be approved by the EC).
    4. d)an approved code of conduct combined with enforceable commitments of a third-country data recipient to apply the ‘appropriate safeguards’ – a new, untested legal instrument; at the moment there are no codes of conduct of this kind;
    5. e)an approved certification mechanism combined with enforceable commitments of a third-country data recipient to apply the ‘appropriate safeguards’ – this is also a new, as yet not fully developed solution;
    6. f)a contract or administrative agreement approved by the supervisory authority, i.e., exceptions:
      • when the standard data protection clauses cannot be relied upon and consent is needed from the supervisory authority;
      • where there is not enough time to sign a formal international agreement between public authorities, and they wish to exchange information.

#11.5 Other Grounds for Transfer

Under Article 49 GDPR, in addition to ‘general’ grounds, the following ‘special’ grounds are possible for data export:

  1. a)consent based on information about the risk;
  2. b)performance of an agreement or to conclude an agreement at an individual’s request;
  3. c)conclusion or performance of an agreement where this is in the interest of a data subject who is not a party to the agreement;
  4. d)public interest;
  5. e)pursuit of legal claims;
  6. f)protection of vital interests of the data subject if they are incapable of giving consent:
  • physically (they are unconscious or dazed) or;
  • legally (incapacitated or a child; in the latter case there is usually a guardian, and therefore it is not clear whether EU lawmakers mean circumventing the guardian or the problem of lack of contact with the guardian, or there is some other logical interpretation of this provision).
  1. g)transfer from a public register according to the normal requirements for access.

#11.6 Transfer in ‘Truly Exceptional Cases’

Under Article 49(2) GDPR, in addition to the general grounds and additional grounds, in exceptional cases data can be transferred on special grounds, which are valid and legitimate interests of the controller.

These grounds can be used where the transfer:

  • is not a recurring transfer (this does not mean that it cannot occur multiple times; but in each instance, it must be connected with a new event and one that in fact is hard to predict);
  • affects a limited number of people (the question of the threshold for a limited number of people might depend, for example, on the means of transport and the number of survivors, because the deceased do not have personal data; a pleasure boat can accommodate several thousand people, and an aeroplane a few hundred at the most);
  • is necessary for the controller’s legitimate interests (‘compelling’ is the word used in the GDPR; the word imperieux in the French version suggests the ‘vital’ interests of the controller);

and where:

  1. 1)there are no overriding interests, rights or freedoms of the data subject;
  2. 2)the controller performs a comprehensive assessment of the situation and as a result:
    • ensures appropriate personal data security measures,
    • informs the supervisory authority.
  3. 3)informs the data subject.

#11.7 Recording Transfer in Exceptional Cases

Article 49(6) GDPR requires anyone who performs data export in exceptional cases (controller or processor) to document the export in the records of data transfer activities. The question is what to do if there is no obligation to keep records of data transfer activities: Do these records have to be created, or can the obligation to keep records be deemed to serve no purpose? Without delving into systemic issues, it would be advisable as a minimum to document the transfer itself, and it is best to also draw up records of data transfer activities straightaway.

#11.8 ‘Long Arm Disclosure’

Under Article 48 GDPR, it is not permitted to transfer or disclose personal data at the request of courts or administrative authorities outside of the EU other than under a mutual legal assistance treaty. This is intended to stop attempts at compulsion by judicial authorities, which US courts typically try to do.

#11.9 Summary

The most practical grounds for transfer of data outside of the EU are either standard data protection clauses (in case of established business to business relations) or a contract (in case of business to employee relations, business to customer or similar). Consent is an inconvenient form of grounds for data export because it can be revoked at any time. They are grounds which are not permanent and require unified management of data and require that an alternative be in place within the EU for the process that is to be normally operated using resources located outside of the EEA. In our opinion a common practice to ‘require’ consent for data processing or data export in return for allowing to use a free application is questionable. If the essence of the service depends on the consent, such consent is not freely given. It is a contract where there is a service and consideration in the form of providing access to one’s data.

Anyway, neither adequacy decisions nor standard data protection clauses provide a defence against the obligation to inform individuals that their data are transferred outside of the EU. Still there are organisations such as the guardian who water this obligation down to that extent that a data subject has no real knowledge what is happening to their data, at least according to the guardian’s privacy policy in place on 26 December 2018.

It is debatable whether this notification obligation applies in the case of individuals whose data are already held, but with respect to people whose data will be obtained subsequent to 25 May 2018, there is no doubt. These individuals must be informed whether there are plans to transfer their data outside the EEA. The GDPR also requires at the same time that this be done in a clearly legible and comprehensive manner. For this reason, where possible, it is best to avoid personal data transfer outside of the EU regardless of whether an organisation is a controller or processor.

Enquiries also need to be made with subcontractors to find out whether they make use of cloud computing outside of the EU or transfer data within their capital group, for example to India or even to the US, to self-certifying companies under the Privacy Shield scheme.

In fact, users in an organisation have to be monitored regularly to check whether they circumvent the company systems and security rules and use, ‘on the side’ for company purposes, publicly available online services that do not guarantee restriction of processing to within the EEA (shadow IT), such as services from leading firms in the Silicon Valley.