Direct answer · GDPR
Transfers to countries outside the EEA
A transfer to a country outside the EEA is possible on three routes, in this order (Article 44): (1) an adequacy decision of the European Commission (Article 45). For the US that is the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), but only for recipients certified under that framework; (2) appropriate safeguards, such as standard contractual clauses or binding corporate rules (Article 46), with an assessment of the law of the third country and, where needed, supplementary measures (Schrems II); (3) only by way of exception, the derogations of Article 49, such as explicit consent; according to the EDPB these must be interpreted restrictively and are not meant for structural transfers.
For you to establish
- Is the US recipient certified under the Data Privacy Framework?
Articles
- Art. 44 GDPR General principle for transfers.
- Art. 45(1) GDPR Transfers on the basis of an adequacy decision.
- Art. 46(2)(c) GDPR Standard contractual clauses as an appropriate safeguard.
- Art. 49(1) GDPR Derogations for specific situations.
Case law
- Schrems II (CJEU, C-311/18, ECLI:EU:C:2020:559, 2020-07-16)Standard contractual clauses require a case-by-case assessment.
Guidelines and decisions
- EU-US Data Privacy Framework (adequacy decision) (European Commission, (EU) 2023/1795, 2023-07-10)Adequacy decision on the EU-US Data Privacy Framework.
- Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 (EDPB, 2018-05-25)The derogations of Article 49 must be interpreted restrictively.
