ITALY Law and Practice Contributed by: Paolo Balboni, Luca Bolognini, Nicolò Maria Salvi and Davide Baldini, ICT Legal Consulting
This therefore requires an examination of the legal provisions applicable to the third country or international organisation in order to under - stand the actual level of protection of personal data, taking into account the elements speci - fied in Article 45(2) of the GDPR. This analysis is carried out by the European Commission when it adopts the adequacy decisions referred to in Article 45 of the GDPR (decisions legitimising the transfer of personal data to the country or organisation benefiting from it). In the absence of an adequacy decision, as clarified by the Court of Justice of the Europe - an Union in its judgment of 16 July 2020 (the “Schrems II” judgment), this assessment is instead the responsibility of the data controller or data processor who is intending to export the personal data. In such a case, where the law in force in the third country or applicable to the international organisation does not guarantee an adequate level of protection of personal data, the transfer may only be carried out subject to the adoption of additional security measures suitable to mitigate the risks to the rights and freedoms of the data subjects (eg, encryption of the data prior to the transfer in order to exclu - sively share encrypted data). 5.2 Government Notifications and Approvals Notification to the supervisory authority is only required in the case of transfers pursuant to Arti - cle 49(1)(2) of the GDPR. This is the case when no other means can be used to legitimise the transfer and requires that the transfer: • is not repetitive;
• concerns a limited number of data subjects; • is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject; • is carried out subject to appropriate data protection safeguards; and • is notified to the supervisory authority by the data controller. 5.3 Data Localisation Requirements European legislation on the protection of per - sonal data does not provide for any obligation to store data within a specific member state or the EEA, aiming, on the contrary, to regulate and facilitate the free movement of such data. In the case of transfers of data to third countries, how - ever, the provisions of Chapter V of the GDPR apply in order to guarantee an adequate level of protection of personal data (see 5.1 Restrictions on International Data Transfers ). 5.4 Blocking Statutes There are no “blocking” statutes in the European data protection legislation in addition to those described in the previous sections concerning the transfer of data outside the EEA. 5.5 Recent Developments In 2024, the European Commission concluded the review process of 11 adequacy decisions regarding the transfer of personal data, con - firming their validity. In this regard, the deci - sions remain effective, and it is permissible to continue the free transfer of personal data to Andorra, Argentina, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland, and Uruguay.
236 CHAMBERS.COM
Powered by FlippingBook