The transfer of personal data outside of the EU is only allowed under certain conditions as set out in Directive 95/46/EC and also in the General Data Protection Regulation which will be fully applicable as of May 2018. If a country is deemed by the European Commission to offer an adequate level of protection, it will be subject to the same rules as an EU Member State, which means that the recipient of the data in that state will not be obliged to take specific measures to allow for the transfer. Transferring data to a country without an adequacy decision requires appropriate safeguards, such as standard contractual clauses or binding corporate rules. Derogations to this rule can be obtained in very specific cases. The European Data Protection Board, of which the EDPS is a member, will provide the Commission with Opinions on this subject.
Opinion of 16 December 2013 on a notification for prior-checking regarding staff evaluation for the probationary period at the European Institute of Innovation and Technology (EIT) (Case 2013-0813)
Opinion on the Proposals for Council Decisions on the conclusion and the signature of the Agreement between Canada and the European Union on the transfer and processing of Passenger Name Record data
Letter on the prior checking notification of the establishment of rights and entitlements upon departure of staff (Case 2013-0728) and the establishment of rights upon recruitment/appointment of staff at Fusion for Energy (Case 2013-0729)
Opinion of 18 July 2013 on the notification for prior checking from the Data Protection Officer of the European Anti-Fraud Office (OLAF) regarding the Investigative Data Consultation Platform (Case 2012-0280)
Opinion on a proposal for a Directive of the European Parliament and of the Council on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing, and a proposal for a Regulation of the European Parliament and of the Council on information on the payer accompanying transfers of funds