Article 44 – General principle for transfers

1 proposes alternative wording.

1. 1307 ~Alternative Axel VossEPP · ITRE–LIBE “Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international…”

   10d.In Article 44, the first paragraph is amended and the following paragraphs 1a and 1b are inserted:

   1.Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the standard of the protection provided for data subjects with regard to general processing of personal data in the third country or by the international organisation is not materially lower than the standard of the protection provided for data subjects by this Regulation.

   1a.In order to ensure a coherent and proportionate application of this Regulation, the assessment of safeguards for transfers of personal data to third countries should take into account the risk-based approach applicable under Articles 24 and 32, including the nature, scope, context and purposes of the processing, as well as the technical and organisational measures implemented by controllers and processors. Such assessment should not affect the requirement that data subjects whose personal data are transferred to third countries continue to benefit from a level of protection of fundamental rights and freedoms essentially equivalent to that guaranteed within the Union, in accordance with the Charter of Fundamental Rights of the European Union and the case law of the Court of Justice of the European Union.

   1b.To support efficient data transfers within multinational corporate groups, supervisory authorities should take into account whether companies apply common internal data protection, security and compliance standards across the group. Where a group has binding internal rules, effective safeguards, and mechanisms to protect data subjects’ rights and remedies, this may create a rebuttable presumption that appropriate safeguards under Article 46 are met. Such presumption should not reduce the level of protection guaranteed under this Regulation, the Charter of Fundamental Rights of the European Union, or the case law of the Court of Justice of the European Union, including regarding access to data by public authorities in third countries.

   Wider passage printed with the amendment

   1.Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.

   Justification

   The amendments support necessary cross-border data flows for EU companies in global value chains, cloud services and multinational groups. Transfer assessments must remain aligned with the Charter and CJEU case law, but should apply a risk-based and proportionate assessment of the safeguards actually used. Where groups apply binding internal rules, common security standards and effective remedies, a rebuttable presumption under Article 46 can reduce formalism without lowering protection or ignoring public-authority access risks.

   Tabled by

   Axel Voss

   Group

   EPP

   Targets

   GDPR Article 44 – paragraphs 1, 1a, 1b (new)

   Document

   ITRE–LIBE amendments 1261–1564 to the draft report

   Source

   Official text, pages 32–34

   Printed header

   Article 3 – paragraph 1 – point 10 d (new) / Regulation (EU) 2016/679 / Article 44 – paragraphs 1, 1a, 1b (new)

   Links

   Link to this amendment
   Cite this amendment
   Preview in the full article