# International Transfer — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/international-transfer > Sources are cited per item. Verify against the official texts before relying on them. Transfer of personal data outside the EU/EEA ## Overview ## Legal Framework Chapter V of the GDPR establishes a tiered framework for transferring personal data outside the EU/EEA. The first mechanism is an adequacy decision under [Article 45](/laws/gdpr/art-45), whereby the European Commission determines that a third country ensures a level of protection essentially equivalent to EU law. > "the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection" > — [GDPR Art. 45](/laws/gdpr/art-45) Where no adequacy decision exists, transfers may proceed under [Article 47](/laws/gdpr/art-47) binding corporate rules or other appropriate safeguards under Article 46, including standard contractual clauses. As a last resort, the narrow derogations in [Article 49(1)](/laws/gdpr/art-49#par-1) permit transfers without safeguards only on specified grounds. > "a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:" > — [GDPR Art. 49(1)](/laws/gdpr/art-49#par-1) ## Key Developments The CJEU's Schrems II ruling established that SCCs require a case-by-case assessment of the third country's legal framework and that transfers must be suspended where domestic law undermines the contractual safeguards. The Court held: > "a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards" > — [Schrems II, CJEU ¶25](/posts/51470#seg-25) The Irish DPA's EUR 1.2 billion fine against Meta confirmed the practical consequence: SCCs supplemented by additional measures may still fall short where the destination country's surveillance regime permits disproportionate government access. The Croatian DPA's EUR 4.5 million fine illustrates enforcement where safeguards lapse: > "transfers continued without SCCs or equivalent safeguards, despite Serbia lacking an adequacy decision" > — [AZOP §1](/posts/49052#seg-1) ## Status of the Debate This topic is actively contested. Schrems II established the principle that transfer mechanisms must account for third-country surveillance laws, but the practical threshold for when supplementary measures suffice remains unresolved. DPAs have diverged on whether encryption, contractual overrides, or pseudonymisation adequately compensate for government access powers. The Meta decision demonstrates that even well-resourced supplementary measures may not withstand scrutiny. No definitive ruling has clarified the precise boundary; further CJEU guidance or EDPB binding decisions would settle the open question. ## Practical Guidance - Map all cross-border data flows and classify each by mechanism: [Article 45](/laws/gdpr/art-45) adequacy, [Article 47](/laws/gdpr/art-47) BCRs, Article 46 SCCs, or [Article 49](/laws/gdpr/art-49) derogation. - For SCC-based transfers, conduct a transfer impact assessment examining the destination country's surveillance laws and implement supplementary measures where government access may exceed EU proportionality standards. - Treat [Article 49(1)](/laws/gdpr/art-49#par-1) derogations as exceptional — explicit consent and contractual necessity require case-by-case justification and cannot serve as routine transfer bases. - For intra-group transfers, pursue [Article 47](/laws/gdpr/art-47) BCRs approved through the Article 63 consistency mechanism, which provide uniform guarantees across all third countries regardless of local protection levels. - Document every transfer decision, including legal basis, risk assessment, supplementary measures, and supervisory authority notification where [Article 49(5)](/laws/gdpr/art-49#par-5) applies. ## Legislation (full text of key provisions) ### Transfers on the basis of an adequacy decision *Source: GDPR, gdpr-art-45-en, 2016-04-27 — https://overview.legal/posts/90855* ### Conformity assessment bodies of third countries *Source: AI Act, aiact-art-39-en, 2024-06-12 — https://overview.legal/posts/92587* Conformity assessment bodies established under the law of a third country with which the Union has concluded an agreement may be authorised to carry out the activities of notified bodies under this Regulation, provided that they meet the requirements laid down in Article 31 or they ensure an equivalent level of compliance. ### General principle for transfers *Source: GDPR, gdpr-art-44-en, 2016-04-27 — https://overview.legal/posts/90853* Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined. ### Transfers or disclosures not authorised by Union law *Source: GDPR, gdpr-art-48-en, 2016-04-27 — https://overview.legal/posts/90925* Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter. ### International cooperation for the protection of personal data *Source: GDPR, gdpr-art-50-en, 2016-04-27 — https://overview.legal/posts/90950* In relation to third countries and international organisations, the Commission and supervisory authorities shall take appropriate steps to: ### Relationship with previously concluded Agreements *Source: GDPR, gdpr-art-96-en, 2016-04-27 — https://overview.legal/posts/91493* International agreements involving the transfer of personal data to third countries or international organisations which were concluded by Member States prior to 24 May 2016, and which comply with Union law as applicable prior to that date, shall remain in force until amended, replaced or revoked. ### Binding corporate rules *Source: GDPR, gdpr-art-47-en, 2016-04-27 — https://overview.legal/posts/90900* ### International cooperation *Source: NIS2, nis2-art-17-en, 2022-12-14 — https://overview.legal/posts/96119* The Union may, where appropriate, conclude international agreements, in accordance with Article 218 TFEU, with third countries or international organisations, allowing and organising their participation in particular activities of the Cooperation Group, the CSIRTs network and EU-CyCLONe. Such agreements shall comply with Union data protection law. ### Recital 107 — revocation of third country adequacy decisions *Source: GDPR, gdpr-rec-107-en, 2016-04-27 — https://overview.legal/posts/91729* The Commission may recognise that a third country, a territory or a specified sector within a third country, or an international organisation no longer ensures an adequate level of data protection. Consequently the transfer of personal data to that third country or international organisation should be prohibited, unless the requirements in this Regulation relating to transfers subject to appropriate safeguards, including binding corporate rules, and derogations for specific situations are fulfilled. In that case, provision should be made for consultations between the Commission and such third countries or international organisations. The Commission should, in a timely manner, inform the third country or international organisation of the reasons and enter into consultations with it in order to remedy the situation. ### Recital 103 — EU adequacy decisions for data transfers *Source: GDPR, gdpr-rec-103-en, 2016-04-27 — https://overview.legal/posts/91721* The Commission may decide with effect for the entire Union that a third country, a territory or specified sector within a third country, or an international organisation, offers an adequate level of data protection, thus providing legal certainty and uniformity throughout the Union as regards the third country or international organisation which is considered to provide such level of protection. In such cases, transfers of personal data to that third country or international organisation may take place without the need to obtain any further authorisation. The Commission may also decide, having given notice and a full statement setting out the reasons to the third country or international organisation, to revoke such a decision. ## Case law ### CJEU - C-311/18 - Facebook Ireland and Schrems *Source: Court of Justice of the European Union, 2026-07-17 — https://overview.legal/posts/125639 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-311/18_-_Facebook_Ireland_and_Schrems* Facts — Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. As is the case with users residing in the European Union, some of the data belonging to Mr. Schrems had been transferred by Facebook Ireland to its servers belonging to Facebook Inc., located in the United States. In 2013, Mr. Schrems complained to the Irish Data Protection Commissioner (DPC) seeking to prohibit these transfers. When this complaint was rejected, he brought an action against the decision before the Irish High Court, which in turn referred a number of questions to the CJEU, the most prominent of which was whether the EU-US adequacy decision, the so-called “Safe Harbor", was valid. In its judgment on October 6th 2015 (Case C-362/14, “Schrems I”), the CJEU invalidated the Safe Harbor and stated that, in order to be "adequate", the level of data protection offered by the third country should be “essentially equivalent” to that being offered in the EU. As a result, the High Court annulled the decision rejecting Mr. Schrems’ complaint, and referred the case back to the DPC. In the remittal “judgment” before the DPC, Facebook Ireland explained that the invalidated adequacy decision was not relevant as a large part of personal data was transferred to Facebook Inc. pursuant to Standard Contractual Clauses (SCCs). On this basis, the DPC asked Mr. Schrems to reformulate his complaint. In his reformulated complaint lodged on December 1st 2015, Mr. Schrems alleged that US law required Facebook Inc. to disclose his personal data to certain United States authorities in the context of various monitoring programs (in particular, the FISA 702 and the Executive Order 12.333). In Mr Schrems’ view, these programs contravened different data protection principles as well as Article 7 CFR, Article 8 CFR, and Article 47 CFR. After investigating the allegations made by Mr. Schrems, the DPC argued that it could not adjudicate on them until the CJEU had examined the validity of the SCCs, and so it brought proceedings before the High Court. On May 4th 2018 the High Court made the reference for a (second) preliminary ruling to the CJEU. In its reference to the CJEU, the High Court specified that Section 702 of the FISA permitted the Attorney General and the Director of National Intelligence to authorize jointly, following FISA approval, the surveillance of individuals who are not US citizens and who are located outside of the US in order to obtain foreign intelligence information. It was also affirmed that Section 702 of the FISA provided the basis for the PRISM and UPSTREAM surveillance programs. PRISM in particular, requires Internet Service Providers (ISPs) to supply the NSA with all communications to and from a ‘selector’. UPSTREAM on the other hand, permitted the NSA to copy and filter Internet traffic flows from the ‘backbone’ of the internet, granting it access to both the content of communications and their metadata. Furthermore, the High Court had found that Executive Order 12.333 (E.O. 12333) allowed the NSA to access data in transit by accessing underwater cables on the floor of the Atlantic. The High Court stated that the only limit on US surveillance activities was found in the Presidential Policy Directive (PPD-28), and even this only stated that intelligence activities should be ‘tailored as feasible’. On the basis of these findings, the High Court considered that the US carried out mass processing of personal data without ensuring a level of protection that was essentially equivalent to that which was guaranteed by Article 7 CFR and Article 8 CFR. The High Court also highlighted that EU citizens did not have the same remedies available to them as US citizens with regards to the processing of their personal data, since the Fourth Amendment to the Constitution of the United States did not apply to non-US citizens. This meant that it was particularly difficult for EU citizens to establish standing before a US court. Moreover, activities based on E.O. 12333 were not subject to judicial oversight and were not justiciable. Given the considerable effects of US surveillance law on the rights of Europeans, the High Court raised the question of whether the SCCs are valid, given that they may not be binding on the State authority of the third country. If they did not bind the third country State authority, then they are not capable of remedying a possible lack of an adequate level of protection of personal data. Dispute — The request for a preliminary ruling referred eleven questions to the Court of Justice. The topics covered in these questions were as follows: the applicability of EU law to data transfers made for commercial purposes, but further processed for national security and law enforcement purposes the relevant legislation for determining whether there has been a violation of individual rights how to assess the level of protection in a third country whether data transfers to the US violate the Charter whether the level of protection offered in the US respects or limits an individual’s right to a judicial remedy what level of protection is required to be afforded to personal data that is transferred under SCCs whether the SCCs can even be adequate as safeguards given they do not bind national authorities whether there is an obligation to suspend data flows if a data importer is subject to surveillance law what the relevance of the Privacy Shield decision is with regards to assessing safeguards whether the presence of an ombudsperson can ensure that the US provides an effective remedy to data subjects whether the SCCs violate the Charter Holding — The Court began by clarifying that the GDPR applies to the transfer of personal data for commercial purposes by an economic operator established in a Member State, to another economic operator established in a third country, even if in that country the data would be processed by the national authorities for public security, defense, and state security purposes. In particular, the Court stressed that a transfer of data is not excluded from the scope of the GDPR for the reason that it may be processed by the national authorities of a third country. Regarding the level of protection required in such an instance, the Court held that the requirements presented by the GDPR regarding safeguards, enforceable rights, and legal remedies must continue to be applied. In other words, when their data is transferred abroad, a data subject must be afforded a level of protection essentially equivalent to that which they would receive in EU. In such circumstances, in order to assess the level of protection, both existing contractual clauses between the data importer and exporter, and the potential access by public authorities in a third country must be taken into account, along with the relevant aspects of the legal system in the third country. The Court then analyzed Decision 2016/1250 (the “Privacy Shield”), which was the self-certification scheme in place for controllers based in the US. Examining the decision in light of the provisions of the Charter, the Court held that the requirements of US national security, public interest, and law enforcement do in fact interfere with the fundamental rights of persons whose data is transferred there. These limitations on the protection of personal data were not circumscribed in a way that satisfied requirements that are essentially equivalent to those required under EU law. The principle of proportionality was also not satisfied, in so far as US surveillance programs are not limited to what is ‘strictly necessary’. It was noted that the provisions in the US surveillance programs neither limited the power they conferred onto national authorities, nor granted data subjects actionable rights before the courts against the US authorities. The Court proceeded to scrutinize the Ombudsperson mechanism that had been in place under the Privacy Shield, stating that it too did not provide data subjects with a cause of action before a body which was fully independent, and that this body was limited in so far as it could not impose rules that were binding on US intelligence services. Taking all of this into account, the Court declared the Privacy Shield Decision to therefore be invalid. The Court also clarified that in the absence of an adequacy decision, the competent supervisory authorities are required to suspend or prohibit a transfer of personal data to a third country where they consider that the standard data protection clauses are not or cannot be complied with in the third country, and that the protection of the data transferred cannot be ensured by other means. Following this, the Court then examined the validity of the SCCs (Decision 2010/87). First, the Court held that the validity of the Decision was not called into question by the mere fact that the SCCs do not bind national authorities in a third country. After establishing this, the Court emphasized that the validity of the SCCs, however, did depend on whether there were effective mechanisms in place that make it possible to ensure compliance with the level of protection required by EU law. Important to note is that here the Court held that the SCCs in themselves did provide for such mechanisms. However, it went on to stress that where these mechanisms cannot be complied with, the transfers of personal data pursuant to these clauses is to be suspended or prohibited. Furthermore, there is an obligation on the data exporter and the recipient of the data to verify prior to a transfer, what the level of protection in a third country is, and whether it will be possible to comply with the requirements of the SCCs. ### Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems *Source: CJEU, 2020-07-16 — https://overview.legal/posts/5945 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311* “the national supervisory authorities are responsible for monitoring compliance with the EU rules concerning the protection of natural persons with regard to the processing of personal data. Each of those authorities is therefore vested with the power to check whether a transfer of personal data from its own Member State to a third country complies with the requirements laid down in that regulation” / “The exercise of that responsibility is of particular importance where personal data is tra ### CJEU - C-362/14 - Schrems I *Source: Court of Justice of the European Union, 2015-06-10 — https://overview.legal/posts/122860 — original: https://gdprhub.eu/index.php?title=CJEU_-_C-362/14_-_Schrems_I* Facts — Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. Some of Mr. Schrems personal data had been transferred by Facebook Ireland to its servers belonging to Facebook Inc., located in the US. Personal data transferred by undertakings such as Facebook Ireland to their parent company established in the US can be accessed by the NSA and other US security agencies in the course of a mass and indiscriminate surveillance. EU citizens have no effective rights to be heard on question of surveillance and interception of their data by the NSA and other US security agencies. The Commission had declared data transfers to the US legal under Article 25(6) of the Data Protection Directive 95/46 (Directive 95/46) when complying with safe-harbor regime by Decision 2000/520 (the Adequacy Decision), finding the US's protection of personal data adequate in Article 1 of the decision, if the recipients adhered to so called safe harbor privacy principles. These included derogations from data protection principles for US national interests. In Article 3 of the decision the Commission heightened the threshold for DPAs to take action within the scope of Article Article 25 of Directive 95/46. In 2013, Mr. Schrems complained to the Irish Data Protection Commissioner (DPC) seeking to prohibit these transfers, claiming that the US did not have an adequate level of protection. When this complaint was rejected, he brought an action against the decision before the Irish High Court, which in turn referred a number of questions to the CJEU, asking in essence whether Article 25(6) of Directive 95/46, read in the light of Articles 7, 8 and 47 CFR, must be interpreted to mean that an Adequacy Decision prevents a DPA from examining the claim of a data subject regarding transfer of personal data to that third country when it contends that the law and practices in force in the third country do not ensure an adequate level of protection. The Advocate General's Opinion — The AG opined, that the derogations provided for in the Adequacy Decision enabling access by US authorities to data transferred to US organisations within the safe harbor regime are too general and not limited to what strictly necessary to adequately protect data from EU based persons. Thus, the AG found the US intelligence services’ access to the transferred data interfering with fundamental rights. The AG considered, that EU citizens using Facebook are not informed that their personal data will be generally accessible to US security agencies and EU citizens have no effective right to be heard on the surveillance and interception of their data. While the AG found that there is an oversight of the US Foreign Intelligence Surveillance Court, the proceedings before it are secret and ex parte, which, in the AG’s opinion, is an interference with the rights of citizens to an effective remedy protected by Article 47 CFR. The AG found it “extremely doubtful” that the limitations at issue may be regarded as respecting the essence of Article 7 or 8 EUCFR as they do not define grounds for the derogations by sufficient precision. Thus, the AG opined that Decision 2000/520 must be declared invalid. The AG stated, that neither private dispute resolution mechanisms or the Federal Trade Commission can challenge access by the US intelligence services to personal data transferred from the EU and that there is no independent authority capable of verifying that the implementation of the derogations is limited to what strictly necessary. Therefore the AG found, that the Commission exceeds the limits imposed by compliance with the principle of proportionality in light of Articles 7, 8 and 52(1) EUCFR. The Adequacy Decision, according to the AG, must therefore be declared invalid since it does not ensure an adequate level of protection of the personal data transferred from the EU to the US under that scheme. The Courts Decision — The CJEU held that the Commission's Safe Harbour decision did not prevent the DPC from examining whether the transfer of user data to the USA by Facebook should be suspended. The court found that DPAs do not have powers on the basis of Article 28 Directive 95/46 regarding processing carried out in a third country. However, the court held, that having personal data transferred from a Member State to a third country constitutes, in itself, processing of personal data and thus found the DPAs vested with the power to check whether a data transfer to a third country complies with the requirements laid down by Directive 95/46. The court found that until a Commission's decision is declared invalid by the it, DPAs cannot adopt measures contrary to that decision as it is in principle presumed to be lawful until withdrawn, annulled or declared invalid. However the court found that Decision 2000/520 cannot prevent persons whose personal data has been or could be transferred to a third country from lodging with the DPA a claim concerning the protection of their rights and freedoms. If, the court reasoned, the DPA rejects it, the complainant must, in the light of Article 47 CFR, have access to judicial remedies. If however the DPA considers the complaint well founded, the court held, it must in accordance with Article 28(3) of Directive 95/46, read in the light in particular of Article 8(3) CFR, be able to engage in legal proceedings. Thus, according to the court, the national legislature must provide for legal remedies enabling the concerned DPA to put forward the objections before the national courts which may make a reference for a preliminary ruling. Thus the court held that Article 25(6) of Directive 95/46, read in the light of Articles 7, 8 and 47 CFR, must be interpreted as meaning that an Adequacy Decision, does not prevent a DPA from examining the claim of a data subject that the law and practices in force in the third country do not ensure an adequate level of protection. Furthermore, the court found that Article 25(6) of Directive 95/46 required for the level of data protection offered a third country to be considered "adequate" it should be “essentially equivalent” to that of the EU as otherwise circumvention of Directive 95/46 would be too easy. The court held, that the Commission is obliged to assess whether a third country's domestic law or international commitments and its compliance practice afford an essentially equivalent protection and check periodically if this assessment is still correct. The court found that the Adequacy Decision in stating that ‘national security, public interest, or law enforcement requirements’ have primacy over the safe harbor principles enables interference with the fundamental rights of the persons whose personal data is or could be transferred to the US. Regarding the derogations and limitations within the Adequacy Decision the court stated - drawing on C‑293/12 and C‑594/12 - that they must apply only in so far as is strictly necessary, which is not the case where legislation generally authorises storage of all the personal data transferred from the EU to the US without any differentiation, limitation or exception. In particular, the court found that legislation permitting the public authorities' access on a generalised basis to the content of electronic communications compromises the essence of the fundamental right to respect for private life, as guaranteed by Article 7 CFR. Likewise, the court held, that legislation not providing for an individual to pursue legal remedies to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 CFR. Consequently, the court held that in including such derogations within its decision the Commission could not state that the US ‘ensures’ an adequate level of protection. Thus the court invalidated Article 1 of the Adequacy Decision, declaring the level of protection in the US adequate. Additionally, the court found, that Article 25(6) of Directive 95/46 does not empower the Commission to eliminate or restrict the powers of the DPAs, thus Article 3 of the Adequacy Decision in restricting the DPAs to act where a data subject calls into question whether an Adequacy Decision is compatible with the protection of the privacy and of the fundamental rights and freedoms of individuals was exceeding the Commissions powers. Therefore the court invalidated Article 3 of the decision. In conclusion, the court held, that as Article 1 and 3 of the decision are inseperably linked it invalidates the decision as a whole. ### Data Protection Commissioner v Facebook Ireland and Maximillian Schrems *Source: CJEU, C-311/18, 2020-07-16 — https://overview.legal/posts/51470 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=51470* Invalidated Privacy Shield adequacy decision and upheld validity of Standard Contractual Clauses with additional safeguards required. ### Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems *Source: CJEU, 2020-07-16 — https://overview.legal/posts/6121 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=6121* “although not requiring a third country to ensure a level of protection identical to that guaranteed in the EU legal order, the term ‘adequate level of protection’ must […] be understood as requiring the third country in fact to ensure, by reason of its domestic law or its international commitments, a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union by virtue of the regulation, read in the light of the Charter. ### Maximillian Schrems v Data Protection Commissioner *Source: CJEU, C-362/14, 2015-10-06 — https://overview.legal/posts/51471 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362&ref=51471* Invalidated Safe Harbor adequacy decision. National supervisory authorities can examine adequacy decisions. ### Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems *Source: CJEU, 2020-07-16 — https://overview.legal/posts/6120 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311&ref=6120* “[…] the standard data protection clauses adopted by the Commission on the basis of Article 46(2)(c) of the GDPR are solely intended to provide contractual guarantees that apply uniformly in all third countries to controllers and processors established in the European Union and, consequently, independently of the level of protection guaranteed in each third country. In so far as those standard data protection clauses cannot, having regard to their very nature, provide guarantees beyond a contrac ### Thomas Bindl v European Commission *Source: General Court, T-354/22, 2025-01-08 — https://overview.legal/posts/132155 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022TJ0354* In Case T-354/22, Thomas Bindl sought annulment of alleged personal data transfers to third countries by the European Commission when visiting the Conference on the Future of Europe website, a declaration of failure to act on his information request, and EUR 1,200 in damages for non-material harm under Regulation (EU) 2018/1725. The General Court found the annulment action inadmissible as the alleged transfers did not constitute a challengeable act, declared there was no need to adjudicate the failure-to-act claim since the Commission had subsequently responded, and dismissed the damages claim for lack of a sufficiently serious breach and causal link. No fine was imposed. ### Data Protection Commissioner v. Schrems and Facebook *Source: CJEU, 2015-10-06 — https://overview.legal/posts/6144 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362&ref=6144* Independence of DPA: The Directive seeks to ensure an effective, complete, and high level of protection of the fundamental rights and freedoms of natural persons. The guarantee of a DPA’s independence is intended to ensure effectiveness and reliability of the monitoring of compliance, and is an essential component of data protection. DPAs powers extend to their own Member State, but not to processing in third countries. However, DPAs are responsible for monitoring transfers from a Member State t ### UZ v Bundesrepublik Deutschland *Source: Court of Justice of the European Union, C-60/22, 2023-05-04 — https://overview.legal/posts/132289 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0060* In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik Deutschland regarding the processing of personal data in an asylum application file. The Court held that an administrative authority transmitting an electronic asylum file to a competent national court via an electronic mailbox constitutes processing under the GDPR, and that where both the authority and the court determine the purposes and means of processing, they are joint controllers under Article 26, requiring an arrangement allocating responsibility and maintaining records of processing activities under Article 30. The Court further clarified that transmission of personal data without the data subject's consent constitutes unlawful processing, triggering the right to erasure under Article 17(1)(d) and the right to restriction under Article 18(1)(b), and that national courts must disregard such unlawfully processed data. No fine was imposed. ### Philippe Latombe v European Commission *Source: General Court, T-553/23, 2025-09-03 — https://overview.legal/posts/132137 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023TJ0553* In Case T-553/23, French citizen Philippe Latombe sought annulment of the European Commission's Implementing Decision (EU) 2023/1795, which found that the United States ensures an adequate level of personal data protection under the EU-US Data Privacy Framework. Latombe challenged the adequacy decision on grounds including infringement of Articles 7 and 8 of the EU Charter, the right to an effective remedy, protections against solely automated decisions, and data security, arguing the framework failed to provide essentially equivalent protection to EU law. The General Court dismissed the action as unfounded, upholding the Commission's adequacy decision. ### Data Protection Commissioner v. Schrems and Facebook *Source: CJEU, 2015-10-06 — https://overview.legal/posts/6145 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362&ref=6145* Necessity/proportionality: The Decision does not contain any finding regarding US rules intended to limit the interference when they pursue legitimate objectives such as national security, nor refer to effective legal protection against such interference. FTC procedures and private dispute resolution mechanisms concern compliance with safe harbor principles (against US organizations) and cannot be applied with respect to measures originating from the State. Moreover, the Commission found that if ## Guidance ### EDPB-EDPS Joint Opinion 2/2021 on standard contractual clauses for the transfer of personal data to third countries *Source: EDPB, edpb-edps-joint-opinion-22021-on-standard-contractual-clauses-for-the-en, 2021-01-14 — https://overview.legal/posts/126083 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-22021-on-standard-contractual-clauses-for-the_en* Adopted 1 EDPB - EDPS Joint Opinion 2 /2021 on the European Commission’s Implementing Decision on standard contractual clauses for the transfer of personal data to third countries for the matters referred to in Article 46(2)(c) of Regulation (EU) 2016/679 Adopted 2 Adopted 4 The European Data Protection Board and the European Data Protection Supervisor Having regard to Article 42(2) of the Regulation 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing… ### Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR *Source: EDPB, guidelines-052021-on-the-interplay-between-the-application-of-article-3-and-the-en, 2023-02-24 — https://overview.legal/posts/125866 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-052021-on-the-interplay-between-the-application-of-article-3-and-the_en* Adopted 1 Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Version 2.0 Adopted on 14 February 2023 Adopted 2 Version history Version 2.0 14 02 2023 Adoption of the Guidelines after public consultation Version 1.0 18 11 2021 Adoption of the Guidelines for public consultation Adopted 3 EXECUTIVE SUMMARY The GDPR does not provide for a legal definition of the notion “transfer of personal data to a… ### Opinion 10/2023 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the PROSEGUR Group *Source: EDPB, opinion-102023-on-the-draft-decision-of-the-spanish-en, 2023-06-30 — https://overview.legal/posts/125845 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-102023-on-the-draft-decision-of-the-spanish_en* Adopted Opinion 10/2023 on the draft decision of the Spanish Supervisory Authority regarding the Controller Binding Corporate Rules of the PROSEGUR Group Adopted on 30 June 2023 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of… ### Opinion 19/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Rubrik Group *Source: EDPB, opinion-192026-on-the-draft-decision-of-the-dutch-supervisory-en, 2026-06-08 — https://overview.legal/posts/125672 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-192026-on-the-draft-decision-of-the-dutch-supervisory_en* Opinion 19/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Rubrik Group Adopted on 08 June 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such… ### Opinion 17/2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Infor Group *Source: EDPB, opinion-172026-on-the-draft-decision-of-the-dutch-supervisory-en, 2026-05-11 — https://overview.legal/posts/125676 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-172026-on-the-draft-decision-of-the-dutch-supervisory_en* Opinion 17 / 2026 on the draft decision of the Dutch Supervisory Authority regarding the Processor Binding Corporate Rules of the Infor Group Adopted on 11 May 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such… ### Opinion 18/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the Collibra Group *Source: EDPB, opinion-182023-on-the-draft-decision-of-the-belgian-en, 2023-11-07 — https://overview.legal/posts/125821 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-182023-on-the-draft-decision-of-the-belgian_en* Adopted Opinion 18/2023 on the draft decision of the Belgian Supervisory Authority regarding the Processor Binding Corporate Rules of the Collibra Group Adopted on 7 November 2023 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement… ### Opinion 25/2025 on the decision of the Polish Supervisory Authority regarding the Processor Binding Corporate Rules of the BOX Group *Source: EDPB, opinion-252025-on-the-decision-of-the-polish-supervisory-en, 2025-10-07 — https://overview.legal/posts/125693 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-252025-on-the-decision-of-the-polish-supervisory_en* Opinion 25/2025 on the decision of the Polish Supervisory Authority regarding the Processor Binding Corporate Rules of the BOX Group Adopted on 07 October 2025 1 | 2 | The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing… ### Opinion 32/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Thalès Group *Source: EDPB, opinion-322023-on-the-draft-decision-of-the-french-en, 2023-11-28 — https://overview.legal/posts/125804 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-322023-on-the-draft-decision-of-the-french_en* Adopted Opinion 32/2023 on the draft decision of the French Supervisory Authority regarding the Processor Binding Corporate Rules of the Thalès Group Adopted on 28 November 2023 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of… ## Enforcement decisions ### EDPS - 2021-0518 *Source: EDPS, 2024-03-08 — https://overview.legal/posts/125645 — original: https://gdprhub.eu/index.php?title=EDPS_-_2021-0518* Facts — Following an investigation in 2019-2020, the EDPS issued recommendations and the Commission modified the ILA. The EDPS investigated whether these modifications were sufficient to bring processing in compliance with data protection requirements and found infringements. Data accessed by Microsoft include identity and contact data of users (when signing on to the service and when checking the licenses), data generated by the users while using the software and data generated by Microsoft based on the usage of the software. The EDPS found that the processing presents significant risks as it monitors the behaviour of users, combines datasets and uses artificial intelligence. Reference date is the 12th May 2021, the date when the investigation was launched. Some measures were taken meanwhile by the Commission, which were taken into account in the recommendations issued. Holding — The EDPS found infringements with regards to purpose limitation, transfers to a third country and further, unathorised disclosure of personal data. Purpose limitation: The EDPS found that it was not sufficiently defined in the International License Agreement (ILA) which types of personal data are to be processed for which purposes. Instead, there was only a list of purposes stating that Microsoft uses these data for: troubleshooting billing remunerating Microsoft staff, internal reporting and business modelling, financial reporting following the use of the system for own reasons (analytics) to improve the service security risk management protection of intellectual property These stated purposes were considered to be too vague and general pursuant to the Art 29 WP. The Commission and Microsoft could not demonstrate that all these data were necessary and that a less intrusive collection of data would be insufficient to achieve the purposes cited. In addition, some of these purposes were actually not in the interest of the Commission but for purposes of individual to Microsoft (like remuneration of their personnel). In this case, the processor acts as controller; thus, these purposes and the data used for this purposes should have been precisely defined. Also, if data were used for purposes other than for which they were collected, the compatibility of these new purposes with the original ones should have been assessed. As a processor, Microsoft should have processed the personal data on documented instructions by the Commission. This was not ensured as the Commission did not issue sufficiently clear documented instructions to Microsoft. For example, though the Commission gave instructions for analytics and improvement of the service, these instructions were not sufficiently detailed and precise and did not exclusively concern uses of data for the purposes of the controller. Some instructions were given orally, but this was not enabled by the ILA and the oral instructions were not documented. The Commission did not assess whether it is necessary and proportionate to transmit data to Microsoft Ireland and its sub-processors. Further details of this infringement are given under the part on further unauthorised disclosure or personal data. Transfer to third countries : The Commission transferred personal data to Microsoft, a company established in the US. This raises questions about adequacy for such transfers to a third country. After the reference date, the Commission adopted the Transatlantic Data Privacy Framework (TDPF), which is an adequacy decision in respect of recipients in the US who register under this framework. The EDPS found that even when the software and data storage is property of Microsoft, it is directly transferred to these subcontractors and cannot therefore be covered by the TDPF to Microsoft US and onward transfer from Microsoft US to other subcontractors under SCCs. The EDPS found that in was not clearly specified in the ILA what types of personal data can be transferred to which recipients in which third country. The Commission also did not appraise the transfers and therefore could not determine whether any supplementary measures are necessary. In addition, the Commission should have performed a data transfer impact assessment and (as there are no SCCs applicable by EUIs as exporters) should have submitted the DPAs with these processors or subprocessors in third countries to the EDPS for approval. Because it failed to do this, the Commission did not implement effective supplementary measures for these transfers. Another issue was that the “EU storage guarantee” offered by Microsoft did not cover all types of data. Some data may be accessible to recipients in third countries. The “EU Data Boundary” also has numerous exceptions and exclusions which cover customer data, service generated data, diagnostic data and professional services data. Further unauthorised disclosure or personal data: A specific reference was made to Article 9 Regulation (EU) 2018/1725, which concerns transmission of personal data by EU institutions to recipients established in the EU. According to the EDPS, this article is also applicable to transmission of personal data to processors of EUIs. Therefore all transmission of personal data should be in the public interest and if the data subject’s legitimate interests may be prejudiced, the controller has to weigh the competing interests and establish that it is proportionate to transmit the personal data. The purpose of management and functioning of the Commission, use of products the staff is familiar with etc. was not found to be the purpose of processing of the personal data by MS. As long as the purposes are not specified, specific and explicit, it is not possible to do this balancing. In addition, the EDPS found that the Commission did not ensure that transfers take place “solely to allow tasks within the competence of the controller to be carried out”. The EDPS determined that organisational and contractual measures to restrict/prevent access of third country authorities were not sufficient, and that further technical measures are thus necessary. The EDPS also found that the organisational measures applied are only limiting transfers but does not ensure that transfers are protected. Further, the encryption is only found to be an adequate measure if the controller is in control of the encryption key. In this case, customers control the keys, but Microsoft has access to the encryption key, and thus, even when law does not oblige it to decrypt the data on an authority request, it may do it voluntarily. Also, the ILA does not detail encryption of data other than “customer data”, i.e. diagnostic data, service generated data or professional services data. The contract also enabled the processor not to notify the Commission about a request of disclosure also when EU or Member State law did not prohibit this notification and enabled recipients in third countries not to notify requests for disclosure also when the law prohibiting it did not constitute a necessary and proportionate measure in a democratic society respecting the essence of the fundamental rights and freedoms recognised by the Charter. ### Austrian DSB: e-marketplace transfer of customer data to China and US requires valid Art. *Source: DSB (Austria), 2026-08-25 — https://overview.legal/posts/291286 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_D130.2269* Facts — The DPA was acting upon a complaint addressing the subject matter of third country personal data transfers. The controller, established in Ireland, operates an e-marketplace platform within the Union that connects costumers with independent vendors mostly located in Asia. The use of the controller’s platform requires potential costumers to create an account with the platform. When a customer orders a product via the platform, the controller establishes the contact between the costumer and the vendor. The parties of the purchase contract, however, are the customer and the vendor, not the controller. The processing of personal data in the context of providing the controller’s platform takes place within the Union and in the United Kingdom. In case of an order, the personal data is transferred to the vendors registered on the platform who offer the requested product. A customer (data subject) created an account with the controller’s platform in 2024. He logged into his account on the platform another time in 2024 and once in 2026, shortly after the procedure before the DPA was concluded. During his log-in in 2026, the data subject placed an order via the controller’s platform. In the course of the order, the data subject’s personal data was transferred to the People’s Republic of China and to two companies within the US. The European Commission has issued an adequacy decision pursuant to Article 45 GDPR concerning data transfers to the US (so-called “Data Privacy Framework”). Both US companies are featured on the “Data Privacy Framework List”. There is no adequacy decision concerning data transfers to the People’s Republic of China. The Irish DPA has declared itself not competent for the procedure at hand. Holding — The DPA held that the complaint at hand cannot be considered an abusive exercise of rights and was legally admissible. The question arose because the DPA considered the complaint as part of a campaign against processing of transfers of personal data to the People’s Republic of China. This is because the data subject was represented by a data protection organisation that has already filed several complaints on that subject matter in the past. Additionally, the data subject has initiated the transfer of personal data to the People’s Republic of China right before the procedure before the DPA by ordering from the controller’s platform. Yet, the DPA held that the data subject based his complaint overwhelmingly on motives relating to the exercise of his individual rights. Despite doubts concerning the incompetence of the Irish DPA, the Austrian DPA declared itself competent for handling the complaint in order to ensure the data subject’s right to an effective remedy as provided for under Article 13 of the European Convention on Human Rights, Article 47 of the Charter of Fundamental Rights of the European Union in conjunction with Article 77 GDPR. As far as the transfer of personal data to a third country is concerned, the DPA held that the transfer of personal data to the two US companies was lawful under the adequacy decision. The two companies were listed in the “Data Privacy Framework List”. As far as the transfer of data to the People’s Republic of China was concerned, for lack of an adequacy decision, the controller based the transfers of personal data on standard data protection clauses pursuant to Article 46(2)(c) GDPR. When relying on standard data protection clauses, the controller must ensure an adequate level of protection of personal data for the processing of personal data in the third country. In this context, the controller cannot solely rely on the contractual relationship and the standard data protection clauses between the data importer and data exporter. The controller has to consider the access of public authorities to personal data as well. The DPA held that the controller was unable to demonstrate an adequate protection of personal data for the transfer to the People’s Republic of China. The controller only referred to the standard data protection clauses and an overview of technical and organisational measures (TOMs). The TOMs did not deal with the issue of access of public authorities. Moreover, the controller failed to provide precise information as to the question of who has control over decryption of personal data. The TOMs merely require the data importer to apply the “commercially available industry standard”. The DPA held that this reference is not precise enough to demonstrate what standard is meant by this wording and if adequate security is ensured. However, the DPA held that Article 49(1)(b) GDPR is applicable in this case. Under Article 49 GDPR, third country data transfers are allowed, in the absence of an adequacy decision or appropriate safeguards pursuant to Article 46 GDPR, only if one of the conditions in Article 49(1) GDPR is fulfilled. According to the DPA, the transfer of personal data to the People’s Republic of China was necessary for the implementation of pre-contractual measures taken at the data subject’s request pursuant to Article 49(1)(b) GDPR. The controller has to transfer the personal data of the data subject to the independent vendor located in a third country in order to fulfil his contractual obligation in the case of a purchase by the data subject. The data subject conducted the purchase on the controller’s platform voluntarily and on his own initiative. According to the DPA, Recital 111 does not prevent the application of Article 49 GDPR in this case. The DPA held that the word “occasional” in Recital 111is to be understood as including “in case of a purchase”. The transfer of personal data occurred only once and not even repeatedly or regularly. The DPA held that the data subject’s request to suspend all data flows of European users lays outside of the subject matter of the case. Moreover, in order for the DPA to impose a suspension, each individual data flow to the third country must be unlawful, which the DPA did not assume at the time being. The DPA rejected the complaint. ### Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 4) *Source: Datatilsynet (Denmark), 2022-09-28 — https://overview.legal/posts/6313 — original: https://gdprhub.eu/index.php?title=Datatilsynet_(Denmark)_-_2020-431-0061_(Helsingor_decision_no._4)* Facts — This is the Danish DPA's fourth decision in the case relating to Helsingor municipality's processing of personal data in primary and lower secondary school. Helsingor municipality, the controller, has been using Google Chromebooks and Workspace for Education in violation of several GDPR requirements, as detailed in the first decision of September 2021, the second decision of 14 July 2022 and the third decision of 18 August 2022. Following the third decision, the municipality submitted more documentation and also requested a consultation with the DPA as per Article 36 GDPR. Holding — The DPA temporarily suspended its processing ban against Helsingor municipality until 5 November 2022, and also ordered the municipality to: Change the data processing agreement with Google so that the DPA's remarks in their 14 July and 18 August decisions, are implemented. This includes, at a minimum, a clarification of where and if Google acts as a sole controller and any uncertainties that may entail that Google acts beyond their role as a processor, see Article 28(3)(a) GDPR. Document that all transfers of personal data to insecure third countries, are in line with the GDPR. Describe all data flows and identify the personal data that are shared with the vendor, and clarify when the vendor acts as a sole or joint controller. This documentation must include the whole technology stack used by the municipality (for this processing activity). Update their data protection impact assessment based on all identified risks. Consult the DPA if the DPIA shows any high risks the municipality is not able to mitigate. If any processing activities are still not in line with the GDPR before the DPA's deadline 3 November 2022, present a final plan for bringing them in line with the GDPR. ### CNPD (Portugal) - Deliberação 2019/494 *Source: CNPD (Portugal), 2019-09-03 — https://overview.legal/posts/122872 — original: https://gdprhub.eu/index.php?title=CNPD_(Portugal)_-_Deliberação_2019/494* Facts — In its Opinion 20/2018 concerning the draft of Law 58/2019 which ensures the implementation of the GDPR in the portuguese national legal framework, the DPA drew the attention of the national legislator to a set of provisions that could potentially violate EU law, particularly the GDPR. The DPA emphasized the primacy of EU law as outlined in the EU treaties, particularly reflecting on Article 288 of the Treaty on the Functioning of the European Union (TFEU) and reinforced by the jurisprudence of the CJEU, which has consistently stated that national laws cannot obstruct the direct applicability of EU regulations and must comply with EU law to ensure uniform implementation across the Member States. However, Law 58/2019 came into force without incorporating all of the DPA's recommendations. The DPA explains that the decision to not apply some of its provisions aims to ensure legal certainty, reinforcing the importance of consistent GDPR application without being hindered by conflicting national rules. Holding — The DPA has decided to disapply the following provisions of Law 58/2019, in cases of personal data processing under its review due to their conflict with the GDPR: Article 2(1)(2): This article broadens the territorial scope of the GDPR to encompass all personal data processing within national territory and processing linked to national establishments outside the territory. The DPA believes this contradicts Article 3 and Article 56 of the GDPR, which outlines the applicable law in cross-border situations. Additionally, it undermines the one-stop-shop mechanism and fails to address instances where the GDPR applies, such as in Portuguese embassies, consulates, ships, and aircraft. Article 20(1): This article states that the right to be informed and the right of access cannot be exercised when a duty of secrecy is imposed on the data controller/processor. In the view of the DPA, this article lacks legal relevance in relation to the GDPR, as it merely repeats provisions already present in the GDPR, particularly concerning the possibility of restricting the data subject's right to information in cases where data collection is indirect and a legal duty of confidentiality exists. Regarding the possibility of restricting the right to information when collecting data directly from the data subject, this right can only be restricted under the provisions of Article 23 GDPR, and Law58/2019 does not meet the requirements therein, thus contradicting the norms of the GDPR and the Charter of Fundamental Rights. Article 23: This article allows public authorities to reuse personal data for any public interest without ensuring compliance with principles of purpose limitation and data minimization (Article 5 GDPR) and could lead to potential misuse of personal data and a violation of individuals’ rights, as it does not ensure that the reuse of data serves the original purpose for which it was collected nor respecting the requirements imposed in Article 23 GDPR. Article 28(3)(a): The employee's consent cannot be the legal basis if the processing results in a legal or economic advantage for the employee. The Portuguese DPA considers it to be a contraction of the doctrine established by European institutions, which accepts employee consent in situations where the act of giving or refusing consent does not, in itself, have negative consequences for the employee. The DPA therefore believes that this provision does not protect the dignity, fundamental rights, and legitimate interests of employees, and thus fails to meet the requirements set forth in Article 9 (2) (b) and Article 88 GDPR. Regime of Administrative Offenses – Articles 37, 38, and 39: The DPA notes that some of the violations outlined in the law contradict the exhaustive list provided in the GDPR (Article 83). The DPA also criticizes the distinction in sanctioning frameworks based on the size of companies and the collective or individual nature of the entities conducting data processing, as the impact on personal data does not depend on those characteristics but rather on the nature of the activity being carried out. Article 61(2) states that "if the expiration of consent is the reason for terminating a contract in which the data subject is a party, the processing of data is lawful until this occurs." The DPA notes that this provision is incongruent, conflating two types of legal basis: consent and contract execution. The contract in which the data subject is a party is sufficient to justify the processing of the data necessary for its execution. Regarding the reasons that led to publish this decision, the Portuguese DPA clarifies that it did so in order to ensure the transparency of its future decision-making processes and, in this regard, contribute to legal certainty and security. It also clarifies that the non-application, in future specific cases, of the legal provisions listed above results in the direct application of the GDPR provisions that were manifestly restricted, contradicted, or compromised in their useful effect. ### IMY (Sweden) - IMY-2024-2904 *Source: IMY (Sweden), 2026-07-03 — https://overview.legal/posts/57263 — original: https://gdprhub.eu/index.php?title=IMY_(Sweden)_-_IMY-2024-2904* Facts — The supervisory authority launched an investigation into the border control unit of the national police authority (the controller) at Arlanda Airport concerning the processing of the personal data of travellers arriving from third countries (the data subjects). During border control, the controller scanned the data subjects’ passports, and some travellers were required to provide fingerprints. The data collected was then possibly checked against various border control systems, such as the Schengen Information System (SIS) and the Visa Information System (VIS). There were no signs, brochures, or other written information on the processing of personal data available directly in the arrival hall. The only information available could be found on the controller’s website. Holding — The DPA issued the controller a reprimand for the infringement of Article 13 GDPR. It held that the controller had not provided the data subjects sufficient information about the processing of personal data during border controls. According to the DPA, the data subjects had not been able to easily access information regarding, among other things, what personal data is collected, how it is processed, and what rights data subjects have. The DPA took into account that not all travellers arriving from third countries could be expected to know which national authority is responsible for border controls, let alone be able to find and understand the information on the controller’s website without any guidance in the arrivals hall. It concluded that the lack of easily accessible information on this matter constituted a significant shortcoming: the border control operations included the processing of sensitive data, including biometric data, of a large number of travellers on a daily basis. On the other hand, the investigation was limited to one arrivals hall. The controller had also obtained signs with tailored information regarding the processing of personal data during border control since the beginning of the investigation. Based on an overall assessment, the DPA held that the lack of information required by Article 13 in the arrivals hall constituted a minor GDPR violation. ### Tele2 Sverige Aktiebolag: Insufficient technical and organisational measures to ensure information security *Source: Data Protection Authority of Sweden, 2023-06-30 — https://overview.legal/posts/48052 — original: https://www.enforcementtracker.com/ETid-1937* The Swedish DPA has imposed a fine of EUR 1 million on Tele2 Sverige Aktiebolag. The Austrian organization None of your Business (NOYB) had filed a complaint against the company in light of the Schrems II judgment, stating that the company was unlawfully transferring personal data to the US. The company had used Google Analytics for visitor statistics and based the data processing by the statistics tool on the EU standard contractual clauses, as no adequacy decision had been issued by the EU Com ### CDON AB: Insufficient technical and organisational measures to ensure information security *Source: Data Protection Authority of Sweden, 2023-06-30 — https://overview.legal/posts/48053 — original: https://www.enforcementtracker.com/ETid-1938* The Swedish DPA has imposed a fine of EUR 25,000 on CDON AB. The Austrian organization None of your Business (NOYB) had filed a complaint against the company in light of the Schrems II judgment, stating that the company was unlawfully transferring personal data to the US. The company had used Google Analytics for visitor statistics and based the data processing by the statistics tool on the EU standard contractual clauses in the absence of an EU Commission adequacy decision for the USA. In the c ### EDPS: European Parliament is sole controller for COVID testing website and failed *Source: EDPS, 2022-01-05 — https://overview.legal/posts/122849 — original: https://gdprhub.eu/index.php?title=EDPS_-_2020-1013* Facts — In January 2021, noyb filed a complaint against the European Parliament on behalf of six Members of the European Parliament over an internal coronavirus testing website. The issues raised were: confusing and unclear cookie banners, vague and unclear data protection notices, and the illegal transfer of data to the US. Holding — On data controllership — According to the EDPS, the processor may enjoy a considerable degree of autonomy in providing its services and may identify the ‘non-essential’ elements of the processing operation. Furthermore, the processor may advise or propose certain measures in this respect, but it is up to the controller to decide whether to accept such advice or proposals. The analysis of the EDPS shows that the European Parliament (EP) delegated some aspects on the setting up and functioning of the website to Ecolog. The EDPS considers the EP acts as the sole data controller for the processing in question (i.e. the operation of the Parliament’s dedicated website) whereas Ecolog acts as a processor. After having assessed the instructions given by the EP to the processor, the EDPS concluded that the EP did not show the necessary diligence required from a data controller and, ultimately, failed to comply with the Regulation on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data 2018/1725 (hereafter Regulation 2018/1725), in particular with Articles 26(1) and 29(1). Moreover, the EDPS considered that the EP failed to provide the necessary detailed instructions to Ecolog for the setting up of the website, including the drafting of the data protection notice. The absence of documented instructions is therefore in violation of Article 29(3) Regulation 2018/1725. Transparency and information requirements — The EDPS confirmed that the data protection notice published at the time of the complaint did not reflect the processing done by the EP, since it merely consisted of a copy of the testing center of Zaventem's airport. Moreover, the reference made in the document to Article 6(1)(f) GDPR was wrong since it stems from the same error. The EDPS confirmed that the EP did not meet its transparency requirements. The EDPS also analysed the updated version of the data protection notice during the procedure and raised several remaining -and even new- inconsistencies and issues. Among other things, the following problems persisted after the data protection notice was updated: a mere reference to Article 15 and 16 Regulation 2018/1725 is misleading as it should apply in its entirety; the reference to the processing of health data is not correct since no such data are processed in the case at hand; the retention period mentioned is not precise enough; the sections of the data protection notices relating to the recipients of the personal data fail to make any reference to the processor; inconsistencies between the different linguistic versions of the data protection notices were still observed: The English and German versions refer to Ecolog and the Laboratory van Poucke as processors under Article 29 Regulation 2018/1725, whereas the French version refers to them as controllers (‘responsables du traitement’). Moreover, the DPO’s contact details on the website refer to Ecolog in all three linguistic versions of the website, when they should be referring to the Parliament Cookies and transfers of personal data to the US — The EDPS confirmed that tracking cookies, such as the Stripe and the Google analytics cookies, are considered personal data, even if the traditional identity parameters of the tracked users are unknown or have been deleted by the tracker after collection. In the same vein, the EDPS rejected the EP's argument and confirmed that upon installation on a device, a cookie cannot be considered ‘inactive’. Every time a user visited Ecolog’s website, personal data was transferred to Stripe through the Stripe cookie, which contained an identifier. The EDPS reached the conclusion that a transfer of data was taking place to the US, via the use of Google and Stripe cookies, since Google Analytics is hosted in the US and the data protection notice referred to a Standard Contractual Clause (SCC) for the transfer of data outside of the EU. However, the Parliament provided no documentation, evidence or other information regarding the contractual, technical or organisational measures in place to ensure an essentially equivalent level of protection to the personal data transferred to the US in the context of the use of cookies on the website. Cookie banner on the Parliament’s dedicated website — The EDPS reminded that: before setting cookies or any other technology falling within the scope of Article 5(3) ePrivacy Directive 2002/58/EC (hereafter ePrivacy Directive), the EU institution must provide the user with adequate information on what is accessed or stored on the user’s terminal equipment, on the purposes of this action and the means for expressing their consent; no action may be performed before the consent is collected. In addition, users must be enabled to withdraw their consent at any time; ‘cookie walls’ are not in line with Regulation 2018/1725, meaning that for consent to be freely given, access to the website’s service and functionalities should not depend on the users’ consent for cookies that are not strictly necessary in the sense described above; in case personal data collected through the cookies are shared with third parties such as analytics partners, the cookie banner should draw the user's attention to it. The EDPS reached the conclusion that the cookie banners in all three languages were not in line with the definition of consent under Article 3(15) Regulation 2018/1725, nor did they meet the requirements of Article 37 Regulation 2018/1725 and Article 5(3) ePrivacy Directive. The cookie banner further failed to provide transparent information regarding the processing of personal data in relation to the cookies on the website. Request for access to personal data — The Parliament was aware that the complainants’ personal data had been processed through the cookies, which were present on the website for the period between 30 September to 4 November 2020, since transfers of personal data had taken place. Consequently, and especially following the EDPS’ inquiry on the matter, the Parliament should have replied to the complainants’ access to personal data request. The Parliament should have provided the relevant information even if it was aware that the processing of the personal data in question was unlawful, as the main purpose of the right of access under Article 15 GDPR is precisely to enable data subjects to become aware of the processing and verify the lawfulness thereof, or exercise other data subject rights. Conclusion — The EDPS concludes that the Parliament has infringed the following articles of Regulation 2018/1725: Articles 26(1) and 29(1) due to its failure to fulfil its responsibilities as controller and use a processor providing sufficient guarantees to implement appropriate technical and organisational measures; Article 29(3) due to its failure to provide documentation relating to the detailed instructions given to the processor for the setting up and functioning of the website; Articles 4(1)(a) and 14, 4(2), and 15 due to its failure to respect the principle of transparency, accountability and the data subjects’ right to information because of the inaccurate data protection notice and cookie banner on the dedicated website; Article 46 and Article 48(2)(b) of the Regulation, due to its reliance on the Standard Contractual Clauses in the absence of a demonstration that data subjects’ personal data transferred to the US were provided an essential equivalent level of protection; Article 37 read in the light of Article 5(3) of the ePrivacy Directive, due to its failure to protect information (the cookies) transmitted to, stored in, related to, processed by and collected from the users’ terminal equipment; Articles 17 and 14(4) due to its failure to reply to the data subjects’ request for access to their personal data. On the basis of the above, the EDPS decides: to issue a reprimand to the Parliament in accordance with Article 58(2)(b) Regulation 2018/1725 for the above infringements; to order the Parliament, pursuant to Article 58(2)(b) Regulation 2018/1725:, to update its data protection notices in the dedicated website in order to provide all relevant information relating to the processing of personal data. The Parliament should address this order within one month from the date of the decision. ## Recent developments ### US Supreme Court just blew up EU-US Data Transfers *Source: noyb - European Center for Digital Rights, 2026-06-29 — https://overview.legal/posts/53122 — original: https://noyb.eu/en/us-supreme-court-just-blew-eu-us-data-transfers* Data Transfers On Monday, the US Supreme Court decided in Trump v. Slaughter that the US Federal Trade Commission (“FTC”) may not be independent anymore. Since 2000, the EU has relied on the “independent” FTC as the enforcer of EU-US deals on personal data. According to EU treaty law, such oversight must be independent. In the current EU-US deal, the European Commission relies on the independent FTC 259 (!) times. Max Schrems: “Given that there are no independent authorities in the US anymore, w ### Strengthening data protection worldwide: EDPB meets with the countries and organisation with an adequacy decision *Source: European Data Protection Board, 2025-12-03 — https://overview.legal/posts/49123 — original: https://www.edpb.europa.eu/news/news/2025/strengthening-data-protection-worldwide-edpb-meets-countries-and-organisation_en* Brussels, 3 December - As part of its December’s plenary meeting, the European Data Protection Board (EDPB) held yesterday an online meeting with Commissioners and representatives of Data Protection Authorities (DPAs) from the countries and the organisation with an EU adequacy decision. This meeting marked the second of its kind, following the first gathering in October 2024. An adequacy decision is a key-mechanism in EU data protection legislation which allows free flow of personal data from Eu ### Strengthening data protection globally: The European Data Protection Board (EDPB) is meeting with countries and organizations that have an adequacy decision. *Source: EDPB, 2025-12-03 — https://overview.legal/posts/52055* Brussels, December 3rd - During its plenary meeting in December, the European Data Protection Board (EDPB) held an online meeting yesterday with commissioners and representatives from national data protection authorities (DPAs) from the countries and organizations that have made a decision regarding adequate protection within the EU. This meeting was the second of its kind, following the first meeting in October 2024. A decision on adequate protection is an important instrument in EU data protection legislation, enabling the free flow of personal data from within the EU. ### Draft UK adequacy decisions: EDPB adopts opinions *Source: EDPB, 2025-10-20 — https://overview.legal/posts/49128 — original: https://www.edpb.europa.eu/news/news/2025/draft-uk-adequacy-decisions-edpb-adopts-opinions_en* Brussels, 20 October - During its latest plenary, the EDPB adopted two opinions on the European Commission’s draft decisions on the extension of the validity of the UK adequacy decisions under the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED) until December 2031.* The EDPB opinions, requested by the Commission as per Art. 70(1) (s) GDPR and Art. 51(1) (g) LED, address the proposed six-year extension of the two UK adequacy decisions which are set to expire in D ### Draft adequacy decision for Brazil: EDPB adopts opinion *Source: EDPB, 2025-11-05 — https://overview.legal/posts/49127 — original: https://www.edpb.europa.eu/news/news/2025/draft-adequacy-decision-brazil-edpb-adopts-opinion_en* Brussels, 5 November - During its latest plenary, the EDPB adopted an opinion on the European Commission’s draft decision on the adequate level of protection of personal data in Brazil.* Once adopted, the decision will ensure that personal data can flow freely from Europe to Brazil and that individuals can retain control over their data. In its opinion, requested by the Commission, the EDPB assesses whether the Brazilian data protection framework and the rules on government access to personal da ## Literature ### International personal data transfer: An analysis of Brazil’s legal system and new LGPD under the adequacy standard of the EU GDPR *Source: Journal of Data Protection Privacy, 2021-06-01 — https://overview.legal/posts/132549 — original: https://doi.org/10.69554/msqx9692* The international transfer of personal data is an issue of fundamental importance in data protection. The General Data Protection Regulation (GDPR) has conditioned all data flow to third countries to stringent alternative requirements, the most important of which being the existence of an adequacy decision made by the European Commission finding the level of data protection afforded by that third country to be equivalent to the one provided by the GDPR. This study aims to apply the adequacy stan ### Territorial Scope and Data Transfer Rules in the GDPR: Realising the EU’s Ambition of Borderless Data Protection *Source: SSRN Electronic Journal, 2021-01-01 — https://overview.legal/posts/132547 — original: https://doi.org/10.2139/ssrn.3827850* ### The transfer of personal data to third countries under the GDPR: when does a recipient country provide an adequate level of protection? *Source: International Data Privacy Law, 2018-07-02 — https://overview.legal/posts/132550 — original: https://doi.org/10.1093/idpl/ipy008* ... As we progress into an electronic age, new risks are posed for the right of privacy of the individual. This development is picking up speed as the internet makes transborder trade relationships possible not only for large enterprises, but also for small companies, as well as for individual consumers. A particular risk for the right to privacy is imposed by cross-border data flows from one jurisdiction to another if the recipient country ensures only a lower level of protection of personal data than the sender country so that the sent information loses part of its protection through the transfer.1 In particular, a transnational data export of this kind makes it easier for private actors to process the personal data for other than the originally intended purposes. Such exports can also make it possible for foreign state agencies to access and process the data.2 The importance of transborder data flows has been recognized for more than 40 years. In 1973, Sweden was the first country to regulate data exports to third countries by making such exports subject to approval by the competent Swedish authority.3 Austria followed suit in 1978 by making the export of personal data to other countries subject to the condition that they guarantee a level of data protection equivalent to that in Austria.4 In 1980, the OECD adopted the first international regulation dealing with transborder data flow, which aimed to set a minimum standard of privacy protection with the objective of facilitating transborder data flows and eliminating the different levels of data protection between the countries.5 ### European Union ∙ EDPB Opinion 14/2019 on Standard Contractual Clauses for Processors under Article 28(8) GDPR *Source: European Data Protection Law Review, 2019-01-01 — https://overview.legal/posts/132531 — original: https://doi.org/10.21552/edpl/2019/4/10* ### Regulatory border effects in digital trade: Estimating the GDPR’s asymmetric impact on EU enterprises’ cross-border e-commerce through a triple difference-in-differences design *Source: International Review of Economics & Finance, 2026-07-10 — https://overview.legal/posts/132114 — original: https://doi.org/10.1016/j.iref.2026.105587* The General Data Protection Regulation (Regulation (EU) 2016/679; GDPR) created a structural asymmetry between intra-EEA and extra-EEA digital transactions, since Articles 44 to 49 imposed compliance burdens on transfers to third countries that have no analogue within the European Economic Area. This paper introduces and operationalises the regulatory border effect (RBE), the wedge between intra-EU and extra-EEA digital sales attributable to the differential cost structure of GDPR Chapter V, and ## Tools ### European Commission adequacy decisions *Source: European Commission, 2026-07-17 — https://overview.legal/posts/125629 — original: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en* The authoritative list of third countries the European Commission has recognised as providing adequate protection under Article 45 GDPR (and its LED equivalent), with links to each adequacy decision and its review status — the first stop for any transfer analysis. ### Standard Contractual Clauses (SCCs) for international transfers *Source: European Commission, 2026-07-04 — https://overview.legal/posts/53805 — original: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en* The European Commission's modernised standard contractual clauses (2021) for transfers of personal data to third countries under Article 46(2)(c) GDPR, plus the controller-processor SCCs under Article 28(7). Includes the official Word/PDF templates for all four transfer modules. ### EDPB Data Protection Guide for Small Business *Source: EDPB, 2026-07-04 — https://overview.legal/posts/53804 — original: https://www.edpb.europa.eu/sme-data-protection-guide/home_en* Interactive guide by the European Data Protection Board that walks SMEs through GDPR compliance: lawful bases, individuals' rights, security of processing, data breach response, and international transfers — with practical examples and checklists. ## Related topics - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Supervision** — https://overview.legal/topics/supervision Oversight and enforcement by supervisory authorities - **Processors** — https://overview.legal/topics/processors Entities that process data on behalf of controllers - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers --- Generated by overview.legal · https://overview.legal/topics/international-transfer · 2026-10-13