Rina Steenkamp - Privacy and technology

My annotated General Data Protection Regulation

[Additional information]

[Directive 95/46/EC]

[Article 25]

Chapter IV Transfer of personal data to third countries

Article 25 Principles

Article 25(1)

1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.

Article 25(2)

2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.

Article 25(3)

3. The Member States and the Commission shall inform each other of cases where they consider that a third country does not ensure an adequate level of protection within the meaning of paragraph 2.

Article 25(4)

4. Where the Commission finds, under the procedure provided for in Article 31 (2), that a third country does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, Member States shall take the measures necessary to prevent any transfer of data of the same type to the third country in question.

Article 25(5)

5. At the appropriate time, the Commission shall enter into negotiations with a view to remedying the situation resulting from the finding made pursuant to paragraph 4.

Article 25(6)

6. The Commission may find, in accordance with the procedure referred to in Article 31 (2), that a third country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.

Member States shall take the measures necessary to comply with the Commission's decision.

[Source: Directive 95/46/EC]

Cross-reference

Article 25(1)

Article 25(1) Directive 95/46/ECArticle 41(1) GDPR

1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.

1. A transfer may take place where the Commission has decided that the third country, or a territory or a processing sector within that third country, or the international organisation in question ensures an adequate level of protection. Such transfer shall not require any specific authorisation.

 Artikel 76 lid 1 Wbp

1. De Lid-Staten bepalen dat persoonsgegevens die aan een verwerking worden onderworpen of die bestemd zijn om na doorgifte te worden verwerkt, slechts naar een derde land mogen worden doorgegeven indien, onverminderd de naleving van de nationale bepalingen die zijn vastgesteld ter uitvoering van de andere bepalingen van deze richtlijn, dat land een passend beschermingsniveau waarborgt.

1. Persoonsgegevens die aan een verwerking worden onderworpen of die bestemd zijn om na hun doorgifte te worden verwerkt, worden slechts naar een land buiten de Europese Unie doorgegeven indien, onverminderd de naleving van de wet, dat land een passend beschermingsniveau waarborgt.

[Context: Article 41 GDPR, Artikel 76 Wbp]

Article 25(2)

Article 25(2) Directive 95/46/ECArticle 41(2) GDPR

2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.

2. When assessing the adequacy of the level of protection, the Commission shall give consideration to the following elements:

  • (a) the rule of law, relevant legislation in force, both general and sectoral, including concerning public security, defence, national security and criminal law as well as the implementation of this legislation, the professional rules and security measures which are complied with in that country or by that international organisation, jurisprudential precedents, as well as effective and enforceable rights including effective administrative and judicial redress for data subjects, in particular for those data subjects residing in the Union whose personal data are being transferred;
  • (b) the existence and effective functioning of one or more independent supervisory authorities in the third country or international organisation in question responsible for ensuring compliance with the data protection rules, including sufficient sanctioning powers, for assisting and advising the data subjects in exercising their rights and for co-operation with the supervisory authorities of the Union and of Member States; and
  • (c) the international commitments the third country or international organisation in question has entered into, in particular any legally binding conventions or instruments with respect to the protection of personal data.

 Artikel 76 lid 2 Wbp

2. Het passend karakter van het door een derde land geboden beschermingsniveau wordt beoordeeld met inachtneming van alle omstandigheden die op de doorgifte van gegevens of op een categorie gegevensdoorgiften van invloed zijn; in het bijzonder wordt rekening gehouden met de aard van de gegevens, met het doeleinde en met de duur van de voorgenomen verwerking of verwerkingen, het land van herkomst en het land van eindbestemming, de algemene en sectoriële rechtsregels die in het betrokken derde land gelden, alsmede de beroepscodes en de veiligheidsmaatregelen die in die landen worden nageleefd.

Het passend karakter van het beschermingsniveau wordt beoordeeld gelet op de omstandigheden die op de doorgifte van gegevens of op een categorie gegevensdoorgiften van invloed zijn. In het bijzonder wordt rekening gehouden met de aard van de gegevens, met het doeleinde of de doeleinden en met de duur van de voorgenomen verwerking of verwerkingen, het land van herkomst en het land van eindbestemming, de algemene en sectoriële rechtsregels die in het betrokken derde land gelden, alsmede de regels van het beroepsleven en de veiligheidsmaatregelen die in die landen worden nageleefd.

[Context: Article 41 GDPR, Artikel 76 Wbp]

Article 25(3)

Article 25(3) Directive 95/46/ECArticle 41(4a) and 41(7) GDPR

3. The Member States and the Commission shall inform each other of cases where they consider that a third country does not ensure an adequate level of protection within the meaning of paragraph 2.

4a. The Commission shall, on an on-going basis, monitor developments in third countries and international organisations that could affect the elements listed in paragraph 2 where a delegated act pursuant to paragraph 3 has been adopted.

7. The Commission shall publish in the Official Journal of the European Union and on its website a list of those third countries, territories and processing sectors within a third country and international organisations where it has decided that an adequate level of protection is or is not ensured.

 Artikel 78 lid 1 sub a Wbp

3. De Lid-Staten en de Commissie brengen elkaar op de hoogte van de gevallen waarin, naar hun oordeel, een derde land geen waarborgen voor een passend beschermingsniveau in de zin van lid 2 biedt.

Onze Minister stelt de Commissie van de Europese Gemeenschappen in kennis van:

  • a. de gevallen waarin, naar zijn oordeel, een derde land geen waarborgen voor een passend beschermingsniveau biedt in de zin van artikel 76, eerste lid

[Context: Article 41 GDPR, Artikel 78 Wbp]

Article 25(4)

Article 25(4) Directive 95/46/ECArticle 41(6) GDPR

4. Where the Commission finds, under the procedure provided for in Article 31 (2), that a third country does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, Member States shall take the measures necessary to prevent any transfer of data of the same type to the third country in question.

6. Where the Commission decides pursuant to paragraph 5, any transfer of personal data to the third country, or a territory or a processing sector within that third country, or the international organisation in question shall be prohibited, without prejudice to Articles 42 to 44. [...]

 Artikel 78 lid 2 sub a Wbp

4. Wanneer de Commissie volgens de procedure van artikel 31, lid 2, constateert dat een derde land geen waarborgen voor een passend beschermingsniveau in de zin van lid 2 biedt, nemen de Lid-Staten de nodige maatregelen om doorgifte van gegevens van dezelfde aard naar het betrokken land te voorkomen.

2. Indien zulks voortvloeit uit een besluit van de Commissie van de Europese Gemeenschappen of de Raad van de Europese Unie, bepaalt Onze Minister bij ministeriële regeling of bij beschikking dat:

  • a. de doorgifte naar een land buiten de Europese Unie is verboden;

[Context: Article 41 GDPR, Artikel 78 Wbp]

Article 25(5)

Article 25(5) Directive 95/46/ECArticle () GDPR

5. At the appropriate time, the Commission shall enter into negotiations with a view to remedying the situation resulting from the finding made pursuant to paragraph 4.

6. [...] At the appropriate time, the Commission shall enter into consultations with the third country or international organisation with a view to remedying the situation resulting from the Decision made pursuant to paragraph 5 of this Article.

[Context: Article 41 GDPR]

Article 25(6)

Article 25(6) Directive 95/46/ECArticle 41(3) GDPR

6. The Commission may find, in accordance with the procedure referred to in Article 31 (2), that a third country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.

Member States shall take the measures necessary to comply with the Commission's decision.

3. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 to decide that a third country, or a territory or a processing sector within that third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2. [...]

 Artikel 78 lid 2 sub b Wbp

6. [...] De Lid-Staten nemen de nodige maatregelen om zich naar het besluit van de Commissie te voegen.

2. Indien zulks voortvloeit uit een besluit van de Commissie van de Europese Gemeenschappen of de Raad van de Europese Unie, bepaalt Onze Minister bij ministeriële regeling of bij beschikking dat: [...]

  • b. een land buiten de unie geacht wordt een passend beschermingsniveau te waarborgen

[Context: Article 41 GDPR, Artikel 78 Wbp]