GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
freely if the European Commission decides that such a non-EU country or international organisation ensures adequate protection for personal data. Such transfer shall not require any specific authorisation (Article 45 of the GDPR). In the absence of such an adequacy decision by the European Commission, transfers of personal data to a non-EU country or international organisation may take place subject to appropriate safeguards provided by the data controller or data processor and on the condition that enforceable data subject rights and effective legal remedies are available. Such transfer shall not require any specific authorisation (Article 46 of the GDPR). Appropriate safeguards may be provided by: • a legally binding and enforceable instrument between public authorities or bodies; • binding corporate rules; • standard data protection clauses adopted by the European Commission; • an approved code of conduct; or • an approved certification mechanism. In the absence of an adequacy decision and appropri - ate safeguards, transfers of personal data to a non-EU country or international organisation may take place only on one of the following conditions (Article 49 of the GDPR): • the data subject has explicitly consented to the proposed transfer after having been informed of the possible risks of such transfer for the data sub - ject due to the absence of an adequacy decision and appropriate safeguards; • the transfer is necessary for the performance of a contract between the data subject and the data controller, or for the implementation of pre-contrac - tual measures taken at the data subject’s request; • the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller and another natural or legal person; • the transfer is necessary for important reasons of public interest;
• the transfer is necessary for the establishment, exercise or defence of legal claims; • the transfer is necessary to protect the vital inter - ests of the data subject or of other persons where the data subject is physically or legally incapable of giving consent; or • the transfer is made from a register which, accord - ing to EU or member state law, is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by EU or member state law for consulta - tion are fulfilled in the particular case. For non-personal data, Article 4 of Regulation (EU) 2018/1807 states that free flow is the rule, and data localisation is the exception, if justified on grounds of public security in accordance with the principle of proportionality. The GDPR does not provide a legal definition of the concept of “transfer of personal data to a third country or an international organisation”. In EDPB Guidelines 5/2021, three cumulative criteria are set out that must be met in order for a processing operation to be char - acterised as a “transfer”: • the controller or processor (“exporter”) is subject to the GDPR with regard to the specific processing; • the exporter discloses by transmission or other - wise makes available personal data that is subject to that processing to another controller, joint con - troller or processor (“importer”); and • the importer is located in a third country, regardless of whether the importer is subject to the GDPR for the given processing under Article 3, or is an inter - national organisation. Furthermore, according to EDPB Recommendation 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, remote access by an entity in a third country to data located in the EEA is also considered a transfer. Therefore, provided that the above criteria are met, remote access is regarded as a transfer.
147 CHAMBERS.COM
Powered by FlippingBook