menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Spain) language
Contact our local member in Spain mail_outline
Visit the website of RPCC Estudio Jurídico account_balance

arrow_backPrevious Article
Article 49
Next Articlearrow_forward

Derogations for specific situations

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 49 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 49 keyboard_arrow_up

Key words related to article 49

Show the recitals of the Regulation related to article 49 keyboard_arrow_down Hide the recitals of the Regulation related to article 49 keyboard_arrow_up

(111) Provisions should be made for the possibility for transfers in certain circumstances where the data subject has given his or her explicit consent, where the transfer is occasional and necessary in relation to a contract or a legal claim, regardless of whether in a judicial procedure or whether in an administrative or any out-of-court procedure, including procedures before regulatory bodies. Provision should also be made for the possibility for transfers where important grounds of public interest laid down by Union or Member State law so require or where the transfer is made from a register established by law and intended for consultation by the public or persons having a legitimate interest. In the latter case, such a transfer should not involve the entirety of the personal data or entire categories of the data contained in the register and, when the register is intended for consultation by persons having a legitimate interest, the transfer should be made only at the request of those persons or, if they are to be the recipients, taking into full account the interests and fundamental rights of the data subject.

(112) Those derogations should in particular apply to data transfers required and necessary for important reasons of public interest, for example in cases of international data exchange between competition authorities, tax or customs administrations, between financial supervisory authorities, between services competent for social security matters, or for public health, for example in the case of contact tracing for contagious diseases or in order to reduce and/or eliminate doping in sport. A transfer of personal data should also be regarded as lawful where it is necessary to protect an interest which is essential for the data subject's or another person's vital interests, including physical integrity or life, if the data subject is incapable of giving consent. In the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of data to a third country or an international organisation. Member States should notify such provisions to the Commission. Any transfer to an international humanitarian organisation of personal data of a data subject who is physically or legally incapable of giving consent, with a view to accomplishing a task incumbent under the Geneva Conventions or to complying with international humanitarian law applicable in armed conflicts, could be considered to be necessary for an important reason of public interest or because it is in the vital interest of the data subject.

(113) Transfers which can be qualified as not repetitive and that only concern a limited number of data subjects, could also be possible for the purposes of the compelling legitimate interests pursued by the controller, when those interests are not overridden by the interests or rights and freedoms of the data subject and when the controller has assessed all the circumstances surrounding the data transfer. The controller should give particular consideration to the nature of the personal data, the purpose and duration of the proposed processing operation or operations, as well as the situation in the country of origin, the third country and the country of final destination, and should provide suitable safeguards to protect fundamental rights and freedoms of natural persons with regard to the processing of their personal data. Such transfers should be possible only in residual cases where none of the other grounds for transfer are applicable. For scientific or historical research purposes or statistical purposes, the legitimate expectations of society for an increase of knowledge should be taken into consideration. The controller should inform the supervisory authority and the data subject about the transfer.

Show the recitals of the Directive related to article 49 keyboard_arrow_down Hide the recitals of the Directive related to article 49 keyboard_arrow_up

(58) Whereas provisions should be made for exemptions from this prohibition in certain circumstances where the data subject has given his consent, where the transfer is necessary in relation to a contract or a legal claim, where protection of an important public interest so requires, for example in cases of international transfers of data between tax or customs administrations or between services competent for social security matters, or where the transfer is made from a register established by law and intended for consultation by the public or persons having a legitimate interest; whereas in this case such a transfer should not involve the entirety of the data or entire categories of the data contained in the register and, when the register is intended for consultation by persons having a legitimate interest, the transfer should be made only at the request of those persons or if they are to be the recipients;

The GDPR

The derogations provided for by the Directive have been maintained and developed in Article 49 of the Regulation. Subject to several adaptations, the derogations already covered by Directive are set out here, such as:

- the explicit consent of the data subject for the transfer (a). Since this derogation is based on consent, the commented provision requires the controller to obtain the “explicit” consent of the data subject to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;

- when the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request (b);

- when the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person (c);

- when the transfer is necessary for important reasons of public interest (d). Recital 112 provides several examples of data transfer needed for important reasons of general interest: in case of international exchange of data between competition authorities, tax or customs administrations, between financial supervisory authorities, between services responsible for matters of social security or public health. In this regard, article 49 (4) specifies that the general interest justifying the transfer must be recognized by the EU law or the national law of the Member State of the controller;

- when the transfer is necessary for the establishment, exercise or defence of legal claims (e);

- when the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent (f). The derogation relating to the vital interests of the data subject, now also seeks the protection of vital interest of others.

- when the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest. The consultation conditions must be met in compliance with the Union or Member State law (g). Paragraph 2 restricts the data that can be subject of a transfer in this case. Such transfer shall not involve the entirety of the personal data or entire categories of the personal data contained in the register.  Finally, where the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients.

The essential innovation of Article 49 is the introduction of a new derogation based on the need for the transfer for the purpose of compelling legitimate interests pursued by the controller or the processor; resorting to this derogation is however strictly controlled.

To invoke this derogation, the transfer

- cannot be based on Articles 45 (adequate level of protection) or 46 (sufficient safeguards) including those related to the binding corporate rules (Article 47) or any other derogations referred to in Articles 49 (1), a) to f);

- must not be repetitive, concerns only a limited number of data subjects, which means to take into consideration the amount of personal data and the number of data subjects and to consider whether the transfer is carried out on an occasional or regular basis.

- must be necessary in the pursuit of “incontestable” legitimate interests of the controller which are not overridden by the interests or rights and freedoms of the data subject;

- the controller or the processor has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. This means that the controller should take into consideration the nature of the data, the purpose and duration of envisaged processing as well as the situation in the country of origin, in the third country and the country of final destination and provide appropriate safeguards to protect fundamental rights and freedoms of natural persons. The final version of the regulation adds that the controller or the processor must document the above assessment and the safeguards taken accordingly (6).

- the controller must not only notify the supervisory authority of said transfer but must also provide additional information to the data subjects regarding the compelling interests that justify the transfer of their data, in addition to the information referred to in articles 13 and 14.

It should be noted that the derogations based on the consent of the data subject, on the contractual need (that is, the exceptions referred to in articles 49 (1) (b) and (c), as well as on compelling legitimate interests of the controller, are not applicable to the activities of the public authorities in the exercise of their prerogative of public power (paragraph 3).

Finally, according to paragraph 5, in the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of personal data to a third country or an international organization.

The Directive

Article 26 of the Directive formulated six exceptions to the prohibition to transfer data to a third country not providing an adequate level of protection. They addressed limited cases presenting risks normally mitigated for the data subject, taking account of the primacy of the public interest or that of the data subject over data protection. According to the Article 29 Working Party, resorting to these exemptions should be the ultimate solution only, when no other provision was made to allow the transfer (G29, Working Document of 24 July 1998, Transfers of Personal Data to Third Countries: Application of Articles 25 and 26 of the Directive on the Data Protection, WP 12). 

These exemptions addressed the following cases: when the data subject had given his explicit consent to the transfer; when the transfer was necessary in the context of a contract or a legal action; when the protection of an important public interest demanded it; or for recognition, exercise or defence of a legal right, for example in the case of international exchange of data between tax or customs administrations or between services competent for social security; when the transfer was necessary to protect the vital interest of the data subject, or when the transfer was made from a register established by law and intended to be viewed by the public or by persons who can prove a legitimate interest.

These exceptions were subject to a strict interpretation, as advocated by the Article 29 Working Party in its Working Paper No. 114 on a common interpretation of the provisions of Article 26 (1) of Directive 95/46/EC of 24 October 1995 adopted on 25 November 2005, as after their transfer, these have no protection.

Potential issues

Article 49 contains the traditional exceptions, already implemented by the Directive. The provision, in admitting an exception to the prohibition of transfer on the basis of indisputable legitimate interests of the controller, is also aimed to facilitate the admission of exceptional transfers to third countries without an adequate level of protection, while safeguarding the rights of the data subject. It could be particularly useful in the event that the data is transferred to a processor outside the EU.

arrow_back Previous Article • Article 49 • Next Article arrow_forward
arrow_back Previous Article • Article 49 Next Article arrow_forward

Summary

European Union

European Union

European data protection board (EDPB)

Guidelines on derogations of Article 49 under Regulation 2016/679 - 2/2018 (25 May 2018)

This document seeks to provide guidance as to the application of Article 49 of the General Data Protection Regulation (GDPR) on derogations in the context of transfers of personal data to third countries.

The document builds on the previous work done by the Working Party of EU Data Protection Authorities established under Article 29 of the Data Protection Directive (the WP29) which is taken over by the European Data Protection Board (EDPB) regarding central questions raised by the application of derogations in the context of transfers of personal data to third countries. This document will be reviewed and if necessary updated, based on the practical experience gained through the application of the GDPR.

When applying Article 49 one must bear in mind that according to Article 44 the data exporter transferring personal data to third countries or international organizations must also meet the conditions of the other provisions of the GDPR. Each processing activity must comply with the relevant data protection provisions, in particular with Articles 5 and 6. Hence, a two-step test must be applied: first, a legal basis must apply to the data processing as such together with all relevant provisions of the GDPR; and as a second step, the provisions of Chapter V must be complied with.

Article 49 (1) states that in the absence of an adequacy decision or of appropriate safeguards, a transfer or a set of transfers of personal data to a third country or an international organization shall take place only under certain conditions. At the same time, Article 44 requires all provisions in Chapter V to be applied in such a way as to ensure that the level of protection of natural persons guaranteed by the GDPR is not undermined. This also implies that recourse to the derogations of Article 49 should never lead to a situation where fundamental rights might be breached.3

The WP29, as predecessor of the EDPB, has long advocated as best practice a layered approach4 to transfers of considering first whether the third country provides an adequate level of protection and ensuring that the exported data will be safeguarded in the third country. If the level of protection is not adequate in light of all the circumstances, the data exporter should consider providing adequate safeguards. Hence, data exporters should first endeavor possibilities to frame the transfer with one of the mechanisms included in Articles 45 and 46 GDPR, and only in their absence use the derogations provided in Article 49 (1).

Therefore, derogations under Article 49 are exemptions from the general principle that personal data may only be transferred to third countries if an adequate level of protection is provided for in the third country or if appropriate safeguards have been adduced and the data subjects enjoy enforceable and effective rights in order to continue to benefit from their fundamental rights and safeguards.5 Due to this fact and in accordance with the principles inherent in European law,6 the derogations must be interpreted restrictively so that the exception does not become the rule.7 This is also supported by the wording of the title of Article 49 which states that derogations are to be used for specific situations (“Derogations for specific situations”).

When considering transferring personal data to third countries or international organizations, data exporters should therefore favour solutions that provide data subjects with a guarantee that they will continue to benefit from the fundamental rights and safeguards to which they are entitled as regards processing of their data once this data has been transferred. As derogations do not provide adequate protection or appropriate safeguards for the personal data transferred and as transfers based on a derogation are not required to have any kind of prior authorisation from the supervisory authorities, transferring personal data to third countries on the basis of derogations leads to increased risks for the rights and freedoms of the data subjects concerned.

Data exporters should also be aware that, in the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly limit transfers of specific categories of personal data to a third country or an international organization (Article 49 (5)).

Link

Retour au sommaire
arrow_back Previous Article • Article 49 Next Article arrow_forward
Retour au sommaire
arrow_back Previous Article • Article 49 Next Article arrow_forward
Regulation
1e 2e

Art. 49

1.   In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

a) the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;

b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request;

c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;

d) the transfer is necessary for important reasons of public interest;

e) the transfer is necessary for the establishment, exercise or defence of legal claims;

f) the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;

g) the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case.

 
1st proposal close

Art. 44

1.           In the absence of an adequacy decision pursuant to Article 41 or of appropriate safeguards pursuant to Article 42, a transfer or a set of transfers of personal data to a third country or an international organisation may take place only on condition that:

(a)     the data subject has consented to the proposed transfer, after having been informed of the risks of such transfers due to the absence of an adequacy decision and appropriate safeguards; or

(b)     the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request; or

(c)     the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person; or

(d)     the transfer is necessary for important grounds of public interest; or

(e)     the transfer is necessary for the establishment, exercise or defence of legal claims; or

(f)      the transfer is necessary in order to protect the vital interests of the data subject or of another person, where the data subject is physically or legally incapable of giving consent; or

(g)     the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in Union or Member State law for consultation are fulfilled in the particular case; or

(h)     the transfer is necessary for the purposes of the legitimate interests pursued by the controller or the processor, which cannot be qualified as frequent or massive, and where the controller or processor has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and based on this assessment adduced appropriate safeguards with respect to the protection of personal data, where necessary.

2.           A transfer pursuant to point (g) of paragraph 1 shall not involve the entirety of the personal data or entire categories of the personal data contained in the register. When the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients.

3.           Where the processing is based on point (h) of paragraph 1, the controller or processor shall give particular consideration to the nature of the data, the purpose and duration of the proposed processing operation or operations, as well as the situation in the country of origin, the third country and the country of final destination, and adduced appropriate safeguards with respect to the protection of personal data, where necessary.

4.           Points (b), (c) and (h) of paragraph 1 shall not apply to activities carried out by public authorities in the exercise of their public powers.

5.           The public interest referred to in point (d) of paragraph 1 must be recognised in Union law or in the law of the Member State to which the controller is subject.

6.           The controller or processor shall document the assessment as well as the appropriate safeguards adduced referred to in point (h) of paragraph 1 of this Article in the documentation referred to in Article 28 and shall inform the supervisory authority of the transfer.

7.           The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying 'important grounds of public interest' within the meaning of point (d) of paragraph 1 as well as the criteria and requirements for appropriate safeguards referred to in point (h) of paragraph 1.
2nd proposal close

Art. 44

1. In the absence of an adequacy decision pursuant to paragraph 3 of  Article 41,or of appropriate safeguards pursuant to Article 42, including binding corporate rules (...), a transfer or a category of transfers of personal data to (...) a third country or an international organisation may take place only on condition that:

(a) the data subject has explicitly consented to the proposed transfer, after having been informed that such transfers may involve risks for the data subject due to the absence of an adequacy decision and appropriate safeguards; or

(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request; or

(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person; or

(d) the transfer is necessary for important reasons of public interest; or

(e) the transfer is necessary for the establishment, exercise or defence of legal claims; or

(f) the transfer is necessary in order to protect the vital interest of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; or

(g) the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest but only to the extent that the conditions laid down in Union or Member State law for consultation are fulfilled in the particular case; or

(h) the transfer, which is not large scale or frequent, is necessary for the purposes of legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject and where the controller (...) has assessed all the circumstances surrounding the data transfer operation or the set of data transfer operations and (...) based on this assessment adduced suitable safeguards with respect to the protection of personal data.

2. A transfer pursuant to point (g) of paragraph 1 shall not involve the entirety of the personal data or entire categories of the personal data contained in the register. When the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients.

3.(...)

4. Points (a), (b), (c) and (h) of paragraph 1shall not apply to activities carried out by public authorities in the exercise of their public powers.

5. The public interest referred to in point (d) of paragraph 1 must be recognised in Union law or in the national law of the Member State to which the controller is subject. (...)

5a. In the absence of an adequacy decision, Union law or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of personal data to a third country or an international organisation. Member States shall notify such provisions to the Commission.

6. The controller or processor shall document the assessment as well as the suitable safeguards (...) referred to in point (h) of paragraph 1 in the records referred to in Article 28 (...).

6a. (...)

7. (...)
Directive close

Art. 26

1. By way of derogation from Article 25 and save where otherwise provided by domestic law governing particular cases, Member States shall provide that a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2) may take place on condition that:

(a) the data subject has given his consent unambiguously to the proposed transfer; or

(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of precontractual measures taken in response to the data subject's request; or

(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or

(d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or

(e) the transfer is necessary in order to protect the vital interests of the data subject; or

(f) the transfer is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case.

2. Without prejudice to paragraph 1, a Member State may authorize a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2), where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights; such safeguards may in particular result from appropriate contractual clauses.

3. The Member State shall inform the Commission and the other Member States of the authorizations it grants pursuant to paragraph 2.

If a Member State or the Commission objects on justified grounds involving the protection of the privacy and fundamental rights and freedoms of individuals, the Commission shall take appropriate measures in accordance with the procedure laid down in Article 31 (2).

Member States shall take the necessary measures to comply with the Commission's decision.

4. Where the Commission decides, in accordance with the procedure referred to in Article 31 (2), that certain standard contractual clauses offer sufficient safeguards as required by paragraph 2, Member States shall take the necessary measures to comply with the Commission's decision.
Spain
compare_arrows
visibility Old law

Artículo 43. Supuestos sometidos a información previa a la autoridad de protección de datos competente.

Los responsables del tratamiento deberán informar a la Agencia Española de Protección de Datos o, en su caso, a las autoridades autonómicas de protección de datos, de cualquier transferencia internacional de datos que pretendan llevar a cabo sobre la base de su necesidad para fines relacionados con intereses legítimos imperiosos perseguidos por aquéllos y la concurrencia del resto de los requisitos previstos en el último párrafo del artículo 49.1 del Reglamento (UE) 2016/679. Asimismo, informarán a los afectados de la transferencia y de los intereses legítimos imperiosos perseguidos.

Esta información deberá facilitarse con carácter previo a la realización de la transferencia.

Lo dispuesto en este artículo no será de aplicación a las actividades llevadas a cabo por las autoridades públicas en el ejercicio de sus poderes públicos, de acuerdo con el artículo 49.3 del Reglamento (UE) 2016/679.

---

Article 43. Cases subject to prior information to the competent data protection authority.

Data controllers shall inform the Spanish Data Protection Agency or, where appropriate, the regional data protection authorities, of any international transfer of data that they intend to carry out on the basis of its necessity for purposes related to compelling legitimate interests pursued by them and the concurrence of the rest of the requirements provided for in the last paragraph of Article 49.1 of Regulation (EU) 2016/679. They shall also inform the data subjects of the transfer and of the overriding legitimate interests pursued.

This information must be provided prior to the transfer. The provisions of this Article shall not apply to activities carried out by public authorities in the exercise of their public powers in accordance with Article 49(3) of Regulation (EU) 2016/679.
Old law close

Article 34 c) to k).- Derogations.- Organic Law 15/1999 on the Protection of Personal Data.-

The provisions of the preceding paragraph shall not apply where:

c) The transfer is necessary for medical prevention or diagnosis, the provision of health aid or medical treatment, or the management of health services.

d) Where the transfer of data is related to money transfers in accordance with the relevant legislation.

e) The data subject has given his unambiguous consent to the proposed transfer.

f) The transfer is necessary for the performance of a contract between the data subject and the controller or the adoption of precontractual measures taken at the data subject's request.

g) The transfer is necessary for the conclusion or performance of a contract concluded, or to be concluded, in the interest of the data subject, between the controller and a third party.

h) The transfer is necessary or legally required to safeguard a public interest. A transfer requested by a tax or customs authority for the performance of its task shall be considered as meeting this condition.

i) The transfer is necessary for the recognition, exercise or defence of a right in legal proceedings.

j) The transfer takes place at the request of a person with a legitimate interest, from a public register, and the request complies with the purpose of the register.

k) The transfer takes place to a Member State of the European Union or to a country which the Commission of the European Communities, in the exercise of its powers, hasdeclared to ensure an adequate level of protection.
arrow_back Previous Article • Article 49 Next Article arrow_forward
close

2016 - www.itiplaw.eu.