Article 32x

(1) Where a re-user intends to transfer certain categories of protected data that are non-personal to a third country, it shall inform the public sector body of its intention to transfer such data and the purpose of such transfer at the time of requesting the re-use of the data and, in any event, prior to the conclusion of any sharing agreement. In the case of re-use based on the data holder’s permission the re-user shall, where appropriate with the assistance of the public sector body, and in any event prior to the conclusion of any contractual transfer agreement, inform the natural or legal person whose rights and interests may be affected of that intention, purpose and the appropriate safeguards. The public sector body shall not allow the re-use unless the natural or legal person gives permission for the transfer.

(1a) In Article 32x, the following paragraph is inserted:

(1b) In Article 32x, the following paragraph is inserted:

(1c) In Article 32x, the following paragraph is added:

(3) The Commission may adopt implementing acts establishing model contractual clauses for complying with the obligations referred to in paragraph 2 of this Article. Those model contractual clauses shall ensure the protection of trade secrets, the protection against the unauthorised transfer of knowledge, and the protection of the economic security of the Union and of its Member States. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2).

(4) Public sector bodies shall, where relevant and to the extent of their capabilities, provide guidance and assistance to re-users in complying with the obligations referred to in paragraph 2, in particular by raising the awareness of the parties concerned of the risks arising from the extraterritorial reach of third-country laws, from the unauthorised transfer of knowledge, and from the misuse or re-identification of the data.

(5) Where justified because of the substantial number of requests across the Union concerning the re-use of non-personal data in specific third countries, the Commission, assisted by the European Data Innovation Board and the European Data Protection Board, may adoptissue implementingguidelines actsassessing declaring thatwhether the legal, supervisory and enforcement arrangements of a third country:

(5a) In Article 32x, the following subparagraph is inserted:

Specific Union legislative acts may deem certain non-personal data categories held by public sector bodies to be highly sensitive for the purposes of this Article where their transfer to third countries may put at risk Union public policy objectives, such as safety and public health or may lead to the risk of re-identification of non-personal,the natural persons from whom pseudonymised or anonymised data originate. Where such an act is adopted, the Commission shall adopt delegated acts in accordance with Article 45 supplementing this Regulationassisted by layingthe downEuropean specialData Innovation Board and the European Data Protection Board, may issue guidelines on the conditions applicable to the transfers of such data to third countries. Such conditions shall be without prejudice to the national economic-security frameworks of the Member States.