It is important to note that the transfer of data to third countries is regulated in Article 14 of Convention 108+. The purpose of this provision is to facilitate, where possible, the free movement of information, regardless of frontiers, while ensuring adequate protection of individuals with regard to the processing of personal data. It sets out the following provisions:
1. The movement of data between the Parties cannot be prohibited or subject to special authorization, as they are all part of the common core of data protection provisions set out in the Convention that provide a level of protection that can be considered appropriate.
2. Cross-border transmission of data to a recipient who is not subject to the jurisdiction of a Contracting Party shall be permitted only if an appropriate level of protection is in place.
3. Exceptions to the requirement of adequate protection of personal data are possible where there is a real and serious risk that such a transfer will circumvent the provisions of the Convention or if a party is obliged to do so due to “harmonized protection rules shared by States belonging to a regional international organization”.
4. The transfer of personal data to third countries or international organizations is permitted if certain conditions for the protection of personal data are met.
5. The free transfer of data to non-Parties is permitted only based on:
• the law of that State or international organization, including applicable international treaties or agreements which provide adequate safeguards;
• special or approved standardized guarantees provided by legally binding and enforceable instruments accepted and applied by persons involved in the transmission and further processing of personal data.
Such appropriate guarantees may be recognized contractual clauses between the data controller and the recipient in the third country and accepted mandatory company rules.
6. Notwithstanding the above rules, data transfer may also take place in the following cases:
– The data subject has given his explicit, specific and free consent once he has been informed about the risks associated with the lack of appropriate protection measures.
– The specific interest of the data subject requires this transfer in this particular case.
– There is a prevailing legitimate interest, in particular public interest, which is provided by law, and such transmission is a necessary and proportionate measure in a democratic society.
– It is a necessary and proportionate measure in a democratic society, especially with regard to freedom of expression.
7. Each Party shall provide that the competent supervisory authority is provided with all relevant information concerning the transfers of data, upon request. The supervisory authority should be entitled to request that the person who transfers data demonstrates the effectiveness of the safeguards or the existence of prevailing legitimate interests and that the supervisory authority may, in order to protect the rights and fundamental freedoms of data subjects, prohibit such transfers, suspend them, or subject them to condition.
8. Member States may also conclude international agreements with third countries or international organizations, which ensure an appropriate level of protection of the fundamental rights and freedoms of individuals, in so far as such agreements do not affect the application of the GDPR.
In 2002, a Manual on contractual clauses governing data protection in the transfer of personal data to third parties, for which an adequate level of data protection is not recognized, was adopted in connection with the implementation of data transfer. The Manual is subject to updating in the light of changes in the EU legal framework and the pursuit of harmonization between data protection legislation within the EU and the Council of Europe.
25.03.2022
