← back to the act's dossier

GDPR — Article 45

The article's text

Article 45 Transfers on the basis of an adequacy decision 1. A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation. 2. in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation. 2. When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements: (a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation which are complied with i
full text
n that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are being transferred; (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organisation is subject, with responsibility for ensuring and enforcing compliance with the data protection rules, including adequate enforcement powers, for assisting and advising the data subjects in exercising their rights and for cooperation with the supervisory authorities of the Member States; and (c) the international commitments the third country or international organisation concerned has entered into, or other obligations arising from legally binding conventions or instruments as well as from its participation in multilateral or regional systems, in particular in relation to the protection of personal data. its participation in multilateral or regional systems, in particular in relation to the protection of personal data. 3. The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). 4. The Commission shall, on an ongoing basis, monitor developments in third countries and international organisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. 5. The Commission shall, where available information reveals, in particular following the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3). shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3). 6. The Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation giving rise to the decision made pursuant to paragraph 5. 7. A decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third country, a territory or one or more specified sectors within that third country, or the international organisation in question pursuant to Articles 46 to 49. 8. The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors within a third country and international organisations for which it has decided that an adequate level of protection is or is no longer ensured. international organisations for which it has decided that an adequate level of protection is or is no longer ensured. 9. Decisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this Article.

Who wrote about this article in the consultations

Filers who named this exact article number in their own text. It is their sentence, not our reading — and not a causal claim.

6
business association
5
company
4
NGO
2
other
1
ACADEMIC_RESEARCH_INSTITTUTION
WhoCountryWhat they wrote
Bitkom e.V.DEhighlighted divergence in the interpretation of rules among various national DPAs. One divergence was highlighted in relation to Article 45/46 GDPR and particularly sensitive data according to Article 9 GDPR. With regard to the current opt-out procedures of t
PostEuropBEpersonal data to third countries or international organizations with particular regard to adequacy decisions adopted pursuant to Article 45(3) and Chapter VII on cooperation and consistency. While a report was submitted in 2020, the current reporting timefram
Selbstregulierung Informationswirtschaft e.V. (SRIW)DEl be highlighted. Third Country Transfers are often safeguarded by redundant mechanisms, such as adequacy deci- sions pursuant to Art. 45 GDPR, standard contractual clauses pursuant to Art. 46.2 (c) GDPR and binding corporate rules pursuant to Art. 47 GDPR.
Asociación Española de Economía Digital (Adigital)ESansfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; and Chapter VII, on co
Telefonica, S.A.ESansfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; and • Chapter VII on c
Oplysningsforbundet May DayDKrtrets artikel 52, stk. 1, andet punktum. Schrems II-dommen statuerer, at Privacy Shield-ordningen ikke er forenelighed med GDPR, art. 45, sammenholdt med EU's Charter om Fundamentale Rettigheder (Charteret) art. 7, 8 og 47 omhandlende privatliv, databeskyttel
United InternetDEansfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; and • Chapter VII on c
Insurance IrelandIEansfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; and • Chapter VII on c
Border Violence Monitoring NetworkDEnstitutions and the rule of law may not be reliable, especially for people on the move.51 Therefore, endangering provisions under Article 45 of the EUDPR.
Fundamental Rights European Experts Group (FREE-Group)BEansfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; (b) Chapter VII on coo
Swiss Finance CouncilCH. Need of legal certainty on adequacy decisions for third countries The European Commission’s adequacy decisions, on the basis of Article 45 of Regulation (EU) 2016/679, as to whether a country outside the EU offers an adequate level of data protection, are es
Federation of Austrian Industries (Industriellenvereinigung)ATare therefore considered necessary. i. Art 45ff – Transfers of personal data to third countries or international organisations Re Art 45 (adequacy decision): The possibility to assess the adequacy of the level of protection as an instrument to regulate data tr
Information Technology and Innovation Foundation (ITIF)UStential subsequent processing is irrelevant.28 In support of its opinion in the Schrems II case, the advocate general referred to Article 45(2) of GDPR, which states that the EC should consider the public authorities’ access to personal data in its assessment
Multi-Regional Clinical Trials Center of Harvard University and Brigham and Women’s HospitalUSalso questions the validity of the Privacy Shield, given “certain doubts as to the conformity of the ‘privacy shield’ decision to Article 45(1) of the GDPR”, the EU Charter of Fundamental Rights and the European Convention on Human Rights.39 As discussed in th
CrowdStrikeUSsuits their organization. Ref. Ares(2020)2300048 - 29/04/2020 III. FEEDBACK ON CROSS-BORDER DATA FLOWS Chapter V Art. 45 To meet GDPR standards of implementing safeguards “appropriate” to the risk to protect personal data, organizations must take into account
EFPIAGBprocessing of personal data and on the free movement of such data (“General Data Protection Regulation”) at Art. 45. xvii CPMP/ICH/135/95ICH, § 4.8. xviii Directive 2001/20/EC, Art. 6(3)(g). xix Id. Art. 5(1)(c). xx Directive 95/46/EC, Art. 12. GDPR, Art. 15 (
French Association of Large Companies (AFEP)FRcomings or inaccuracies during the preparation of its future report. Some of these corrections are related to adequacy decisions (art 45) and standard contractual clauses ( "SCC" - art 46), which are major tools in companies daily- life for both the practical
International Society for Biological and Environmental Repositories (ISBER)USalso questions the validity of the Privacy Shield, given “certain doubts as to the conformity of the ‘privacy shield’ decision to Article 45(1) of the GDPR”, the EU Charter of Fundamental Rights and the European Convention on Human Rights.39 As discussed in th

Source: public consultation submissions and position papers. n = 18 mentions; counted as a literal reference to the article number.

Ask about this article →