menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Austria) language
Contact our local member in Austria mail_outline
Visit the website of Geistwert account_balance

arrow_backPrevious Article
Article 48
Next Articlearrow_forward

Transfers or disclosures not authorised by Union law

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 48 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 48 keyboard_arrow_up

Key words related to article 48

Show the recitals of the Regulation related to article 48 keyboard_arrow_down Hide the recitals of the Regulation related to article 48 keyboard_arrow_up

(115) Some third countries adopt laws, regulations and other legal acts which purport to directly regulate the processing activities of natural and legal persons under the jurisdiction of the Member States. This may include judgments of courts or tribunals or decisions of administrative authorities in third countries requiring a controller or processor to transfer or disclose personal data, and which are not based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State. The extraterritorial application of those laws, regulations and other legal acts may be in breach of international law and may impede the attainment of the protection of natural persons ensured in the Union by this Regulation. Transfers should only be allowed where the conditions of this Regulation for a transfer to third countries are met. This may be the case, inter alia, where disclosure is necessary for an important ground of public interest recognised in Union or Member State law to which the controller is subject.

There is no recital in the Directive related to article 48.

The GDPR

The final version of the Regulation introduces a new Article 48 under which a judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognized or enforceable if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State.

In the absence of an international agreement in force, no judgment or decision from outside the EU require a transfer of personal data.

This provision does not affect transfers of data which would be carried out on another basis provided for in chapter V of the Regulation.

The Directive

The Directive included no similar provision.

Potential issues

The EU seems here to legalize its doctrine resulting from the Swift  case. Even though having no powers over foreign jurisdictions and foreign administrative authorities, the EU puts controllers and processors established in Europe in breach of the Regulation as soon as they submit themselves to foreign orders. We guess that the goal is more political than legal.

arrow_back Previous Article • Article 48 • Next Article arrow_forward
arrow_back Previous Article • Article 48 Next Article arrow_forward
arrow_back Previous Article • Article 48 Next Article arrow_forward
Retour au sommaire
arrow_back Previous Article • Article 48 Next Article arrow_forward
Regulation
1e 2e

Art. 48

Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.

 
1st proposal close

No specific provision
2nd proposal close

No specific provision
Directive close

No specific provision
Austria
compare_arrows

No specific provisions, but in force until May 25, 2018:

§ 12 DSG 2000

[...]

(3) Furthermore, data exchange shall not require authorisation if

[...]

3. the transmission or committing is authorized by regulations that are equivalent to a statute in the Austrian legal system and are immediately applicable or

[...]

7. the transmission is necessary for the establishment, exercise or defence of legal claims before a foreign authority and the data were collected legitimately or

[...]
Czechia close

Act No. 101/2000 Coll., on the Protection of Personal Data and on Amendments to Certain Acts, as amended - repealed as of April 24, 2019

Art. 27

(...)

(3) Where the condition pursuant to paragraphs 1 and 2 is not met, the transfer of personal data may be carried out if the controller proves that:

(a) the data transfer takes place with the consent of, or on the basis of an instruction by the data subject;

(b) in a third country, where personal data are to be processed, has been created sufficient specific guarantees for personal data protection, e.g. by other legal or professional regulations and security measures. Such guarantees may be specified in particular by a contract concluded between the controller and the recipient, if this contract ensures application of these requirements, or if the contract contains contractual clauses for personal data transfer to third countries published in the Official Journal of the Office;

(c) the personal data concerned are part of publicly accessible data files on the basis of a special Act or are, on the basis of a special Act accessible to someone who proves legal interest; in such case the personal data may be disclosed only in the scope and under conditions provided by a special Act;

(d) the transfer is necessary to exercise an important public interest following from a special Act or from an international treaty binding the Czech Republic;

(e) the transfer is necessary for negotiating the conclusion or change of a contract, carried out on the data subject´s incentive, or for the performance of a contract to which the data subject is a contracting party;

(f) the transfer is necessary to perform a contract between the controller and a third party, concluded in the interest of the data subject, or to exercise other legal claims, or(g) the transfer is necessary for the protection of rights or important vital interests of the data subject, in particular for rescuing life or providing health services.
arrow_back Previous Article • Article 48 Next Article arrow_forward
close

2016 - www.itiplaw.eu.