Article 32 – International governmental access and transfer

Providers of data processing services, the public sector body making available data in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation shall take all adequate technical, organisational and legal measures, including contracts, in order to prevent international and third-country governmental access and transfer of non-personal data held in the Union where such transfer or access would create a conflict with Union law or with the national law of the relevant Member State, including criminal law provisions of Member States, or national law provisions protecting their essential security interests within the meaning of Article 4(2) of the Treaty on European Union, without prejudice to paragraph 2 or 3.

Any decision or judgment of a third-country court or tribunal and any decision of a third-country administrative authority requiring a provider of data processing services, the public sector body making available data in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union shall be recognised or enforceable in any manner only if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union, or any such agreement between the requesting third country and a Member State.

In the absence of an international agreement as referred to in paragraph 2, where a provider of data processing services, the public sector body making available data in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data in accordance with Chapter VIIc Section 3 was granted, a data intermediation services provider or a recognised data altruism organisation is the addressee of a decision or judgment of a third-country court or tribunal or a decision of a third-country administrative authority to transfer or give access to non-personal data falling within the scope of this Regulation held in the Union and compliance with such a decision or judgement would risk putting the addressee in conflict with Union law or with the national law of the relevant Member State, transfer to or access to such data by that third-country authority shall take place only where:

If the conditions laid down in paragraph 2 or 3 are met, the provider of data processing services, the public sector body making available data in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall provide the minimum amount of data permissible in response to a request, on the basis of the reasonable interpretation of that request by the provider or relevant national body or authority referred to in paragraph 3, second subparagraph.

The provider of data processing services, the public sector body making available data in accordance with Chapter VIIc Section 3, the natural or legal person to which the right to re-use data in accordance with Chapter VIIc Section 3 was granted, the data intermediation services provider or the recognised data altruism organisation shall inform the natural or legal person whose rights and interests might be affected about the existence of a request of a third-country authority to access its data before complying with that request, except where the request serves law enforcement purposes and for as long as this is necessary to preserve the effectiveness of the law enforcement activity.