The GDPR: Transfers and Enforcement

In one line

Chapter V says personal data may leave Europe only if the protection travels with it, and the enforcement chapter puts a percentage of worldwide turnover behind everything else.

In the wording a student can write in an exam: Chapter V of Regulation (EU) 2016/679 permits a transfer of personal data to a third country only on the basis of an adequacy decision under article 45, appropriate safeguards under article 46 with enforceable rights and effective remedies, binding corporate rules under article 47, or one of the derogations in article 49, and article 48 provides that a judgment or decision of a third country authority requiring transfer is not a ground for transfer unless based on an international agreement; Chapter VI establishes independent supervisory authorities with the investigative, corrective and authorisation powers in article 58; and Chapter VIII gives rights to complain, to an effective judicial remedy and to compensation, and empowers administrative fines of up to twenty million euros or four per cent of total worldwide annual turnover, whichever is higher.

Why transfers are regulated at all

Because a right that ends at the border is not a right. If a controller could move data to a State with no protection and process it freely there, Chapter III's rights would be defeated by a routing decision.

So Chapter V does not prohibit transfers; it requires the protection to travel. Article 44 states the general principle: any transfer to a third country or international organisation shall take place only if, subject to the other provisions of the Regulation, the conditions in Chapter V are complied with by the controller and processor, including for onward transfers, and all provisions shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

Article 45: adequacy

A transfer may take place where the Commission has decided that the third country, a territory or one or more specified sectors within it, or the international organisation, ensures an adequate level of protection. Such a transfer requires no specific authorisation.

Article 45(2) lists what the Commission takes into account: the rule of law, respect for human rights and fundamental freedoms, relevant legislation both general and sectoral including on public security, defence, national security and criminal law and the access of public authorities to personal data, and effective and enforceable data subject rights and effective administrative and judicial redress; the existence and effective functioning of one or more independent supervisory authorities with adequate enforcement powers; and the international commitments the country has entered into.

Article 45(3) requires a periodic review at least every four years, and article 45(5) permits repeal, amendment or suspension where a country no longer ensures adequacy.