The transfer of personal data outside of the EU is only allowed under certain conditions as set out in Directive 95/46/EC and also in the General Data Protection Regulation which will be fully applicable as of May 2018. If a country is deemed by the European Commission to offer an adequate level of protection, it will be subject to the same rules as an EU Member State, which means that the recipient of the data in that state will not be obliged to take specific measures to allow for the transfer. Transferring data to a country without an adequacy decision requires appropriate safeguards, such as standard contractual clauses or binding corporate rules. Derogations to this rule can be obtained in very specific cases. The European Data Protection Board, of which the EDPS is a member, will provide the Commission with Opinions on this subject.
Answer to a consultation on the transfer of staff data to Permanent Representations of Member States and similar recipients (Case 2013-0147)
Letter regarding a notification for prior-checking on the "Transfer of Data to the Scientific Council" by the ERCEA (Case 2012-0831)
Opinion on the Commission proposal for a Regulation amending Council Regulation (EC) No 1346/2000 on insolvency proceedings
Additional EDPS Comments of on the Data Protection Reform Package
Opinion on the Proposal for a Regulation amending Regulation (EC) No 273/2004 on drug precursors and the Proposal for a Regulation amending Council Regulation (EC) No 111/2005 laying down rules for the monitoring of trade between the Community and third countries in drug precursors