← back to the act's dossier

GDPR — Article 49

The article's text

Article 49 Derogations for specific situations 1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions: (a) the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards; (b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request; (c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person; (d) the transfer is necessary for important reasons of public interest; (e) the transfer is necessary for the establishment, exercise or defence of legal claims; (f) the transfer is necessary in order to protect the vita
full text
l interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; (g) the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case. that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case. Where a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate rules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is applicable, a transfer to a third country or an international organisation may take place only if the transfer is not repetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject, and the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data. The controller shall inform the supervisory authority of the transfer. The controller shall, in addition to providing the information referred to in Articles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued. 2. A transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the entirety of the personal data or entire categories of the personal data contained in the register. Where the register is intended for consultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if they are to be the recipients. interest, the transfer shall be made only at the request of those persons or if they are to be the recipients. 3. Points (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph thereof shall not apply to activities carried out by public authorities in the exercise of their public powers. 4. The public interest referred to in point (d) of the first subparagraph of paragraph 1 shall be recognised in Union law or in the law of the Member State to which the controller is subject. 5. In the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest, expressly set limits to the transfer of specific categories of personal data to a third country or an international organisation. Member States shall notify such provisions to the Commission. data to a third country or an international organisation. Member States shall notify such provisions to the Commission. 6. The controller or processor shall document the assessment as well as the suitable safeguards referred to in the second subparagraph of paragraph 1 of this Article in the records referred to in Article 30.

Who wrote about this article in the consultations

Filers who named this exact article number in their own text. It is their sentence, not our reading — and not a causal claim.

9
business association
2
ACADEMIC_RESEARCH_INSTITTUTION
2
company
1
other
1
?
WhoCountryWhat they wrote
German Insurance AssociationDEfinalized. The restriction of the possibility of consent by the data subject limits the self-determination expressly regulated by Art. 49 GDPR to give this consent. Art. 8 ECHR already sets clear limits for such a restriction of the data subject. c. Are there
MyData-TRUSTBEboth organizations would reap huge benefits from such assurance. With regards to derogations, those within Art. 49 GDPR are last resort options only to be used when there is no adequacy decision and appropriate safeguards cannot be established Guidelines issu
The Information Technology Industry Council (ITI)USand the streamlining of approval processes under Articles 40-43 GDPR to encourage their widespread adoption. 6 Article 49 Derogations EDPB Guidelines 2/2018 on derogations of Article 49 GDPR1 introduce an overly strict interpretation of “occasional and not rep
ICANN Business ConstituencyUSfor the purpose of establishment, exercise or defence of legal claims is considered a lawful basis of processing, consistent with Article 49(e). Conclusion We respecƞully submit that while GDPR has many lasƟng good effects, its impact on WHOIS, overall, has bee
Coalition for Online AccountabilityUSfor the purpose of establishment, exercise or defence of legal claims is considered a lawful basis of processing, consistent with Article 49(e). CONCLUSION We respectfully submit that issuing the above clarifications will serve to further promote the objective
Creativity Works!BEfor the purpose of establishment, exercise or defence of legal claims is considered a lawful basis of processing, consistent with Article 49(e). Therefore, we urge European authorities to carefully assess the negative consequences of an impenetrable WHOIS data
Insurance EuropeBEeen limited due to the high requirements imposed by the EDPB and long and complex approval processes. Derogations provided for in Art. 49 GDPR should also not be interpreted too narrowly. Barriers to new technologies 2 4 • The EC, as the guardian of European
Federation of Austrian IndustriesATirmatively saying they also use an intragroup EU SCCs, which are similar to BCRs, in exceptional cases also consents in line with Art 49 GDPR – here the information obligations regarding the risks are challenging. Another answered they use Binding Corporate Ru
International Society for Biological and Environmental Repositories (ISBER)USa, as anonymized in the hands of that holder and (2) to add processing necessary for research as an express public interest under Article 49, permitting transfer of data to a jurisdiction lacking a European Commission adequacy decision, provided that such tran
Ecommerce EuropeBEmembers also reported that Art. 49 (1) (b) is predominantly interpreted very narrowly by the DPAs of the Member States. Following this strict interpretation, a data transfer out of the EU should only be permitted on this basis if the contractual relationship m
Global Alliance for Genomics and HealthCAivacy regime, and to adopt adequacy arrangements that can cover more entities who are processing personal data. Derogations under Article 49 Explicit consent may be used as a legal mechanism for international personal data transfers under Article 49(1)(a).
Multi-Regional Clinical Trials Center of Harvard University and Brigham and Women’s HospitalUSt or “important reasons of public interest” as a condition for transfer arises under the EDPB Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 (the “Guidelines”).
(Art. 23.1(e)), “important grounds of public interest” (Art. 28.3(a)), “important reasons of public interest” (Art. 49.1(d)/49.5) and “reasons of substantial public interest” (Art. 9.2(g)). - Transfer of personal data aimed in Chapter V of the GDPR. It is real
EFPIAGBe 95/46/EC and Art. 45 GDPR. xxii Id. Art. 26(2) Directive 95/46/EC and Art. 46 GDPR. xxiii Id. Art. 26(1) Directive 95/46/EC and Art. 49 GDPR. xxiv Id. Art. 25(2) Directive 95/46/EC and Art. 45 GDPR. xxv http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELE
SkyGBecision or possessing its own bespoke transfer mechanism (e.g. Privacy Shield). Aside from the limited exceptions available under Article 49 GDPR, the only obvious option, therefore, would be for an organisation to submit a set of data protection clauses to a

Source: public consultation submissions and position papers. n = 15 mentions; counted as a literal reference to the article number.

Ask about this article →