The transfer of personal data outside of the EU is only allowed under certain conditions as set out in Directive 95/46/EC and also in the General Data Protection Regulation which will be fully applicable as of May 2018. If a country is deemed by the European Commission to offer an adequate level of protection, it will be subject to the same rules as an EU Member State, which means that the recipient of the data in that state will not be obliged to take specific measures to allow for the transfer. Transferring data to a country without an adequacy decision requires appropriate safeguards, such as standard contractual clauses or binding corporate rules. Derogations to this rule can be obtained in very specific cases. The European Data Protection Board, of which the EDPS is a member, will provide the Commission with Opinions on this subject.
Opinion on the proposal for a Regulation of the European Parliament and of the Council concerning customs enforcement of intellectual property rights, OJ C 363/01, 13.12.2011, p1
Opinion on the Proposal for a Regulation of the European Parliament and of the Council on European statistics on safety from crime, OJ C 343/01, 23.11.2011, p.1
See also the text of the "Proposal for a regulation of the European Parliament and of the Council on European statistics on safety from crime".
Opinion on the Proposal for a Council Decision on the conclusion of an Agreement between the European Union and Australia on the processing and transfer of Passenger Name Record (PNR) data by air carriers to the Australian Customs and Border Protection Service, OJ C 322/01, 23.12.2011, p.1
Opinion on the Proposal for a Directive of the European Parliament and of the Council amending Directives 89/666/EEC, 2005/56/EC and 2009/101/EC as regards the interconnection of central, commercial and companies registers, OJ C 220/01, 26.07.2011, p.1
Answer to a consultation regarding transfer of personal data of EFSA external experts by EFSA to American Express Corporate Travel SA (AMEX). (Case 2009-390)