I am challenged to apply article 49 (derogations) for an international organisation, according to art.4 (26). Basically the attempt is to claim that when a user is entering data on some web application of the international organisation, it is a "transfer", so chapter V would apply.

My understanding is:

  1. art.44 general principle reads ""Any transfer.... shall take place only if ... the conditions laid down in this Chapter are complied with by the controller and processor...", which already implies the involvement of a controller and processor. In the interpretation of the "transfer" as data entering, the controller/processor does not exist or should coincide either with the Data Subject or with the international organisation, which sounds weird to me.

Is it stated clearly somewhere that the international organisation cannot be also the controller in the framework of the Chapter V articles? Is it stated clearly or deducted in some ways (from law) that the Data Subject cannot be him/herself the Controller of his own information that he/she... transfers(when entering data) into the international organisation web application?

  1. Art. 13 (1)(f) clearly references Chapter V articles (46, 47, 49) in a context where it is the controller which transfers the data to the international organisation.

Does it help (and on which legal grounds?) to exclude that chapter V articles apply in the case of a Data subject transferring(entering) data into an international organisation web application? Again, which legal grounds exclude the Controller in the Art. 13 to coincide with the Data Subject?


The concept of an international transfer is orthogonal to other processing. The GDPR does not restrict the concept of transfers to those where the source is a controller. Instead:

  • the source of an international transfer can be a data subject, controller, or processor (GDPR does not mention or restrict the source)
  • the target of an international transfer can be (per Recital 101)
    • a controller or processor in a third country
    • an international organization in the sense of Art 4(26)

So yes, if someone (controller, processor, data subject) enters information in the website of an international organization that is an international transfer of this data. That international organization acts as the data controller here. Nothing in the GDPR provides a blanket exception from data controller responsibilities for international organizations.

It is not impossible that a data subject of some processing is simultaneously the controller responsible for that data processing. For example, a sole trader offers some service that involves personal data, and is themselves a user of this service. However, in such a scenario the data subject rights become meaningless because the subject/controller can satisfy these rights directly (you cannot violate your own rights). In practice, it is more useful to assume that the data subject and the data controller are distinct entities.

Who the controller is in your scenario depends solely on who meets the Art 4(7) definition: who determines the purposes of processing? And what are these purposes?

  • The international organization determines the purposes for how this data is processed, it is therefore potentially a controller.
  • But the processing purposes must fall under Union or Member state law (compare Art 2(2), Art 4(7)).
  • If the processing purposes fall outside of Union or Member State law, then the GDPR does not apply and the international organization cannot be treated as the controller for that processing.
  • Such processing would then have no controller in the sense of the GDPR.

So assuming that some specific processing activity by an international organization is not subject to the GDPR, would sending personal data to this organization still be a transfer?

Generally yes, but it is the controller's job to ensure the safety of this transfer (Art 44). So we have to distinguish two cases:

  • personal data is transferred from a controller to the international organization that is not a controller for this processing. Here, the controller is responsible for compliance and must protect the transfer pursuant to chapter 5.
  • personal data is transferred directly from a data subject to the international organization that is not a controller for this processing. Here, no controller exists, and the entire transfer falls out of scope of the GDPR.

For you, this means that you should check whether the processing really falls outside the scope of Union or Member State law.

  • If the processing is within scope of the GDPR, then the international organization is a controller, and it must comply with the requirements for international transfers as per chapter 5.
  • If the processing falls out of scope of the GDPR, no compliance requirements exist, also not any requirements about international transfers.
| improve this answer | |
  • Thank you very much. It is very enlightening and usefull. The discussion helped me a lot to clarify the context and situation. Indeed there is a point I can focus now. The overall point here is that the IO wants to claim it is compliant with GDPR. The temptation was to claim that IO is easily compliant because art. 49 applies to IO interpreting that in this particular case the data subject is also the controller transferring data to the IO. This is actually a non sense because compliance is defined by the GDPR only for the controller, art. 24(3). – Flosta Jul 21 '19 at 20:12
  • So, there is no way to claim compliance for the IO, even it were possible to interpret the transfer of art.49 from a data subject considered the controller of the sent data, as only the controller could get compliance and in this interpretation the controller would be the... data subject, not the IO. I think I will try to add this answer. – Flosta Jul 21 '19 at 20:18
  • 1
    @Flosta The IO can kind of claim compliance by showing that GDPR doesn't even apply here. Or the IO can (voluntarily) submit to GDPR and take on the responsibilities of a data controller, in which case the international transfer would have to be covered by chapter 5. Here, additional safeguards through binding corporate rules (Art 46(2)(b)) would seem to be the best approach, alternatively consent as per Art 49(1)(a). Legal theories that the data subject is their own controller are probably incorrect here. – amon Jul 22 '19 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.