International Transfers and DPO

International data transfers (Arts. 44-49 GDPR)

Any flow of personal data from the European Economic Area (EEA) to a third country is considered an international transfer requiring specific safeguards.

Mechanisms to legitimize transfers

The GDPR establishes a three-level system:

1. Adequacy decisions (Art. 45): The European Commission determines certain countries offer equivalent protection. Countries include: UK, Switzerland, Japan, Canada, Argentina, Uruguay, Israel, South Korea, and since July 2023, the United States (under the EU-US Data Privacy Framework).

2. Standard Contractual Clauses (Art. 46): The most used mechanism when no adequacy decision exists. Since June 2021, a new modular set of SCCs (Decision 2021/914) replaces previous versions.

3. Derogations (Art. 49): Only for occasional transfers: explicit informed consent, contract execution, public interest, legal claims defense.

Schrems II: practical implications

The Schrems II ruling (C-311/18, July 2020) invalidated the EU-US Privacy Shield and established that SCCs require a prior Transfer Impact Assessment (TIA) of the recipient country's legislation.

---

The Data Protection Officer (DPO)

When mandatory (Art. 37 GDPR)

DPO appointment is mandatory when:

1. Processing by a public authority or body
2. Core activities require regular and systematic monitoring at large scale
3. Core activities consist of large-scale processing of sensitive data

DPO functions (Art. 39)

Inform and advise, supervise compliance, cooperate with supervisory authority, advise on DPIAs.

External vs internal DPO

External: greater independence, fee-based, better for SMEs. Internal: deeper business knowledge, fixed salary, better for large enterprises.