Article 45
Transfers based on adequacy decisions
A transfer of personal data to a third country or an international organization may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organization in question ensures an adequate level of protection. No specific consent is required for such a transfer.
In assessing the adequacy of the level of protection, the Commission shall take particular account of the following aspects:
The rule of law, respect for human rights and fundamental freedoms, applicable general and sectoral legislation, including on public security, defense, national security and criminal law and access by public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for onward transfers of personal data to another third country or international organization that are complied with in that country or international organization, precedents in case law, as well as the existence of effective and enforceable data subjects' rights and effective administrative or judicial redress mechanisms for data subjects whose personal data are transferred;
the existence and effective functioning of one or more independent supervisory authorities in the third country or to which an international organization is subject, which have the task of ensuring compliance with data protection rules and enforcing them, including through appropriate enforcement powers, assisting and advising data subjects in the exercise of their rights and cooperating with the supervisory authorities of the Member States; and
international commitments made by the third country or international organization in question, or other obligations arising from legally binding agreements or instruments, as well as the participation of that third country or international organization in multilateral or regional arrangements, in particular with respect to the protection of personal data.
The Commission may, after assessing whether the level of protection is adequate, decide, by means of an implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organization ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for periodic review, at least every four years, taking into account any relevant developments in the third country or international organization. The implementing act shall specify the territorial and sectoral scope and, where appropriate, the supervisory authority or authorities referred to in paragraph 2(b) of this Article.) The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).
The Commission shall continuously monitor developments in third countries and international organizations that may affect the operation of acts adopted pursuant to paragraph 3 of this Article and of acts adopted pursuant to Article 25(6) of Directive 95/46/EC.
Where available information indicates, in particular as a result of the review referred to in paragraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or an international organization no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, the Commission shall, where necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by means of implementing acts without retroactive effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).
On duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3).
The Commission shall consult with the third country or international organization with a view to remedying the situation as a result of which the decision was adopted pursuant to paragraph 5.
A decision adopted pursuant to paragraph 5 of this Article shall not affect transfers of personal data to the third country, or a territory or one or more specified sectors within that third country, or the international organization in question pursuant to Articles 46 to 49.
The Commission shall publish in the Official Journal of the European Union and on its website a list of the third countries, territories and specified sectors in third countries and international organizations for which it has determined, by decision, that they ensure or no longer ensure an adequate level of protection.
Acts adopted by the Commission pursuant to Article 25(6) of Directive 95/46/EC shall remain in force until amended, replaced or repealed by a Commission decision adopted pursuant to paragraph 3 or 5 of this Article.
