ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
Furthermore, where the processing of personal data is based on consent (eg, in the case of processing for promotional purposes or in the context of scientific research), it is essential to verify the correctness and ability to prove the consents collected from the data subjects and the effective capacity of the systems to receive any requests for withdrawal and/or opposition. Following the M&A transaction, it is also essential that data subjects receive a communication inform - ing them of the change in the identity of the data con - troller, as well as any other changes relating to the processing of personal data (new contact channels for the data controller and the Data Protection Officer, new methods for exercising rights, any transfer of data to third countries, etc). This communication should be provided upon first contact with the data subject or within 30 days. European data protection legislation requires that any transfer of personal data that is undergoing processing or is intended for processing after transfer to a third country or to an international organisation (including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation) shall take place only if the level of protection of natural persons guaranteed by the GDPR is not undermined. This therefore requires an examination of the legal pro - visions applicable to the third country or international organisation in order to understand the actual level of protection of personal data, taking into account the elements specified in Article 45 (2) of the GDPR. This analysis is carried out by the European Commission when it adopts the adequacy decisions referred to in Article 45 of the GDPR (decisions legitimising the transfer of personal data to the country or organisation benefiting from it). 5. International Considerations 5.1 Restrictions on International Data Transfers In the absence of an adequacy decision, as clari - fied by the CJEU in its judgment of 16 July 2020 (the Schrems II judgment), this assessment is instead the
responsibility of the data controller or data processor who is intending to export the personal data. In such a case, where the law in force in the third country or applicable to the international organisation does not guarantee an adequate level of protection of personal data, the transfer may only be carried out subject to the adoption of additional security measures suitable to mitigate the risks to the rights and freedoms of the data subjects (eg, encryption of the data prior to the transfer in order to exclusively share encrypted data). With reference to non-personal data , see 5.2 Gov- ernment Notifications and Approvals and 5.3 Data Localisation Requirements . 5.2 Government Notifications and Approvals With reference to personal data , notification to the supervisory authority is only required in the case of transfers pursuant to Article 49 (1)(2) of the GDPR. This is the case when no other means can be used to legitimise the transfer, and requires that the transfer: • is not repetitive; • concerns a limited number of data subjects; • is necessary for the purposes of compelling legiti - mate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject; • is carried out subject to appropriate data protec - tion safeguards; and • is notified to the supervisory authority by the data controller. With reference to non-personal data , Article 32 of the Data Act works as a safeguard against third-country authorities trying to obtain non-personal data stored in the EU from cloud/data-processing providers. A for - eign court order or administrative decision is enforce - able in the EU only if it is based on an international agreement with the EU or a member state (for exam - ple, a mutual legal assistance treaty). If no such agree - ment exists and compliance would conflict with EU or national law, the provider may grant access only where the third-country legal system offers solid rule- of-law guarantees: • the order must be reasoned, specific and propor - tionate;
211 CHAMBERS.COM
Powered by FlippingBook