GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou, Gavrilis - GKP Law Firm
Appropriate safeguards In the absence of an adequacy decision by the European Commission as described above, transfers of personal data to a non-EU coun - try or international organisation may take place subject to appropriate safeguards provided by the data controller or data processor and on condition that enforceable data subject rights and effective legal remedies are available. Such transfer shall not require any specific authorisa - tion (Article 46 of the GDPR). Appropriate safe - guards may be provided by: • a legally binding and enforceable instrument between public authorities or bodies; • binding corporate rules; • standard data protection clauses adopted by the European Commission; • an approved code of conduct; or • an approved certification mechanism. Derogations for specific situations In the absence of an adequacy decision and appropriate safeguards, transfers of personal data to a non-EU country or international organi - sation may take place exceptionally only on one of the following conditions (Article 49 of the GDPR): • the data subject has explicitly consented to the proposed transfer after having been informed of the possible risks of such transfer for the data subject due to the absence of an adequacy decision and appropriate safe - guards; • the transfer is necessary for the performance of a contract between the data subject and the data controller or the implementation of pre-contractual measures taken at the data subject’s request; • the transfer is necessary for the conclusion or performance of a contract concluded in the
pany can take place only with the express writ - ten consent of the data subjects, following their appropriate information. ” 5. International Considerations 5.1 Restrictions on International Data Transfers Transfers of Personal Data Within the EU The transfer of personal data from an EU mem - ber state to another EU member state may take place freely (Article 44 of the GDPR), provided the other provisions of the GDPR are met. Transfers of Personal Data to a Non-EU Country or International Organisation Adequacy decisions The transfer of personal data from an EU mem - ber state to a non-EU country or international organisation may take place freely if the Euro - pean Commission decides that such a non-EU country or international organisation ensures adequate protection for personal data. Such transfer shall not require any specific authorisa - tion (Article 45 of the GDPR). The European Commission has so far issued adequacy decisions for the following: Andorra, Argentina, Canada, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zea - land, South Korea, Switzerland, the UK, Uruguay and the USA (commercial organisations that are included in the “Data Privacy Framework List” maintained and publicly available by the U.S. Department of Commerce). With the exception of the UK, the above-men - tioned adequacy decisions do not cover data exchanges in the law enforcement sector, which are governed by Law Enforcement Directive (EU) 2016/680.
159 CHAMBERS.COM
Powered by FlippingBook