Recommended
Recommended
More Related Content
More from joanna_kornas
More from joanna_kornas (15)
Recently uploaded
Recently uploaded (20)
GRAPH: GDPR cross-border transfers of personal data
- 1. Chapter V of the GDPR applies Is the transfer imposed by the third country court/ tribunal etc.? Is there EC adequacy decision? Is there an international agreement with regard to the transfer? Transfer forbidden Transfer allowed Is there EU or national law limiting the transfer? Check the restrictions Enforceable rights & effective legal remedies available? Apply the restrictions Transfer forbidden Transfer allowed only within the limited scope Check appropriate safeguards: Art. 46 par. 2: Art. 49 par. 1 subpara 2: a) legal instrument between public authorities or bodies b) binding corporate rules c) EC's standard data protection clauses d) national standard data protection clauses approved by EC e) approved code of conduct f) approved certification mechanism Do you use at least 1 of these appropriate safeguards? No national GDPR authority specific authorisation required Do you use any other appropriate safeguards? Transfer allowed National GDPR authority specific authorisation required Is specific authorisation obtained and still valid? Transfer allowed Check the conditions from Art. 49 par. 1 subpara 1: (a) (b) (c) (d) (e) (f) (g) Are you a public authority exercising its power? No points (a)-(c) applicable Points (a)-(g) applicable the data subject informed of risks of the transfer the data subject explicitly consented to the proposed transfer contract between the data subject & the controller concluded pre-contractual stage transfer necessary for the performance of the contract data subject request pre-contractual measures must be implemented (transfer necessary) the controller & third party contract in the interest of the data subject the transfer is necessary for important reasons of the public interest public interest in the EU or controller Member State law transfer necessary for the conclusion of the contract transfer necessary for the performance of the contract the establishment, exercise or defence of legal claims the transfer is necessary for this purpose the data subject physically or legally incapable of giving consent protection of the vital interests of the data subject or other persons the transfer is necessary for this purpose a register contains the personal data the transfer made from the register the transfer made only within the legal access rules the register intended to provide information to the public no transfer of all the data from the register no transfer of entire category of data from the register the register open to public in general the register open to any person with a legitimate interest transfer at the request of such a person transfer if such a person is the recipient of the personal data the EU or Member State law provides the access rules to the register Do you meet at least one of the requirements set out in points (a)-(g)? transfer allowed (only within the met requirements) Is the transfer of personal data repetitive? Does the transfer concern only a limited number of data subjects? Transfer forbidden Is the transfer necessary for the controller's compelling legitimate interest? Transfer forbidden is the interest overridden by the data subject's interests, rights or freedoms? Transfer forbidden Transfer forbidden Controller: compulsory transfer assessment Are suitable safeguards provided on the basis of the assessment? Assessments and safeguards: to be put in the Art.30 records Transfer forbidden National GDPR supervision authority to be informed of the transfer Separate information to the data subject of the transfer Transfer allowed I want to transfer personal data outside the EEA!* *third country or international organisation See: Art. 45 The decision must refer to the place of transfer of personal data! YES NO See: Art. 48 NO YES YES NO See: Art. 48 YES NO See: Art. 46 par. 1 The question refers to the target location with regard to the data subject protecton. And yes: you need to analyze this on your own and decide on the outcome See also: Art. 44 YES NO YES NO YES YES NO NO YES NO which requirements are met? all the following conditions must be met all the following conditions must be met all the following conditions must be met all the following conditions must be met all the following conditions must be met YES NO YES NO YES NO YES NO YES NO YES NO See: Art. 49 par. 5 See: Art. 46 par. 3 Remember: the authorisation must be valid as long as the transfer occurs! See: Art. 49 par. 3 Only after having been informed! all the following conditions must be met See also: Art. 49 par. 2 See: Art. 49 par. 6 Disclaimer: This is not for playing. This is for educational and sharing-knowledge purposes only. This is my interpretation of the GDPR. Not for commercial use. To be used only upon citing the source. All rights copyrighted, reserved and conserved. Choking hazard: very high. Created by Joanna Kornas 20.08.2020, version 1.0 GDPR: transfer of the personal data outside the EU published on: https://cawemo.com/share/02df9707-6b83-422f-a09a-dd562fe15bdd