0

A membership organisation based in the EEA receives membership applications from people based outside of the EEA, in countries which do not have an adequacy decision. During the course of the applications and membership, it needs to communicate with the individuals, including sending them personal data pertaining to themselves or others.

Two questions:

  1. Would sending the data to the individual member constitute a restricted transfer?
  2. If so, how could this be done lawfully in accordance with the GDPR?

The same principles would apply to an EEA business wanting to send personal data to customers or clients (who are individual data subjects) outside of the EEA in countries for which no adequacy decision had been made.

1

GDPR chapter 5 which discusses international transfers applies to:

transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country

Since you are merely communicating with the data subject but are not exporting the data for processing, I think you can largely set the rules on international transfers aside.

In any case, GDPR Art 49 contains derogations for specific situations. An international transfer is permissible e.g. if the data subject has given informed consent, or if the transfer is necessary to fulfil or prepare a contract with the data subject.

| improve this answer | |
  • Sending the data to the data subject would fall within the definition of processing in Article 4(2), and in this example would involve transferring it to a third country. gdpr-info.eu/art-4-gdpr Explicit consent - the derogation under Article 49(1)(a) - is an option, but relying on this has its limitations. The DS would have to be informed of the risks. gdpr-info.eu/art-49-gdpr The 49(1)(b) derogation for contracts has limitations too. It can only be used for occasional, not regular, transfers - recital 111 gdpr-info.eu/recitals/no-111. – whispersan Aug 7 at 16:32
  • @whispersan I agree that a transfer is an act of processing. I find it admittedly difficult to construct a solid argument that transfers to the data subject are exempt, even though this would seem to be the only reasonable result. My above argument that the data is not transferred for processing in the third country is weak because Art 44 also applies to data that is already undergoing processing. An alternative argument is that data subjects are not a Recipient in the sense of Art 4(9), so that Recital 101 indicates no international transfer has occurred. – amon Aug 8 at 8:33
  • Note that Art 49(1)(b) contains no limitation to occasional transfers, it is only transfers under a compelling legitimate interest that must be non-repetitive. Recitals introduce goals and guide interpretation, but the articles are the normative law. – amon Aug 8 at 8:33
  • Thank you amon. I've been trying to make sense of what the UK supervisory authority has said about it: "This exception explicitly states that it can only be used for occasional restricted transfers." ico.org.uk/for-organisations/guide-to-data-protection/… Recital 111 was the only reference I could find suggesting that this derogation is limited to occasional transfers. – whispersan Aug 8 at 9:20
  • @whispersan This boils down to the interpretation of “occasional”, which is a much weaker constraint than “non-repetitive”. Even under your restrictive interpretation of international transfers, you'll be fine if you don't get non-EEA applications regularly. I think the ICO is overstressing the word “expliclty” in their guidance, but it leads readers to the correct understanding: that Art 49 should only be considered if other mechanisms like safeguards/SCCs are not appropriate, for which merely occasional transfers would be an indication. – amon Aug 8 at 10:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.