Data transmission to countries outside the European Union (third countries)

Background

The European Commission has, in accordance with Article 45 (3) DSGVO (General Data Protection Regulation), the possibility to adopt so-called adequacy decisions for the transfer of personal data to countries outside the European Union, so-called third countries. The adequacy decision for a third country states that this country provides adequate protection of personal data in accordance with the GDPR ...is showing.

These adequacy decisions may relate to entire countries or only to parts or sectors of these countries. Monaco is mentioned as an example. Monaco is generally classified as a third country. However, for the financial transactions sector, an adequacy decision has been taken, so that the transfer of personal data allows this context without further action.

If personal data is to be transferred to third countries without an adequate level of data protection outside the EU, the controller (for example, the managing director of a company) must ensure that the data transfer to third countries still complies with the laws of the GDPR. There are several ways to do this, which are briefly explained below.

Variants of data transmission between countries

The following data transmission variants personal data to other countries are distinguished and also taken into account in Robin Data:

1. Data transmission within the countries of the EU
2. Data transfer from EU countries to countries with an adequate level of data protection
3. Data transmission to the USA on the basis of EU-US Data Privacy Framework
4. Data transfer from EU countries to countries without an adequate level of data protection (third countries)

The cases are briefly explained below from the perspective of a European processor and solutions to the lawful transfer of personal data are presented.

1. Data transmission between countries within the EU

If personal data is transferred to countries within the EU, no further action is necessary from a data protection perspective. All countries within the EU are subject to the GDPR.

Bottom line: The protection of personal data is sufficiently regulated and can be transferred without restriction.

2. Data transmission to countries with an adequate level of data protection

For countries with an adequate level of data protection, no further action is necessary when personal data are transferred to these countries. These countries are therefore privileged: they are treated in the same way as countries within the EU.

Currently, the following countries have an adequate level of data protection (Official EU list of countries with adequate levels of data protection):

• • • Andorra
    • Argentina
    • Canada
    • Faroe Islands
    • Guernsey
    • Israel
    • Isle of Man
    • Japan
    • Jersey
    • New Zealand
    • Republic of Korea
    • Switzerland
    • United Kingdom (under the GDPR and the LED)
    • United States (commercial organisations operating on EU-US data protection framework participate)
    • Uruguay

Bottom line: Personal data may be transferred to such countries without further restriction.