EDPB adopts Guidelines on data transfers subject to appropriate safeguards under the Law Enforcement Directive

Sep 27, 2023

Source: European Data Protection Board

During its latest plenary, the EDPB adopted Guidelines on Art. 37 of the Law Enforcement Directive (LED). These Guidelines aim to provide practical guidance on the application of Art. 37 LED concerning transfers of personal data by competent authorities of EU countries to third country authorities or international organisations, competent in the field of law enforcement. In particular, these Guidelines aim to provide clarity on the legal standard for appropriate safeguards that competent authorities need to apply pursuant to Art.37(1)(a) and (b) LED and, accordingly, on the relevant factors for the assessment of whether such safeguards exist.

The Guidelines aim to serve as a reference for EU countries when they envisage concluding or amending the transfer instruments under Art. 37 (a) LED. In this respect, these guidelines also provide guidance to national data protection authorities (DPAs) in case they are consulted or otherwise involved in the negotiation of such instruments or where they subsequently review their implementation. Furthermore, these guidelines address the role of DPAs in the context of the data controller’s accountability obligations according to Art. 37(2) and (3) LED.

The Guidelines reiterate that any transfer of personal data requires an essentially equivalent level of protection in the recipient third country or international organisation and that transfers should by no means undermine the level of protection applicable in the EU. Furthermore, the Guidelines address the use of a legally binding instrument (Art. 37 (a) LED) compared to an assessment by a controller (Art. 37 (b) LED), and stress that the latter should only be relied on when this assessment is based on a careful analysis of the relevant legal framework and practices establishing that the transfer in question is subject to appropriate safeguards.

In addition, the Guidelines include practical guidance, such as a list of elements that should be addressed in a legally binding instrument as well as examples for categorising and assessing the circumstances of a transfer.

The Guidelines will be subject to public consultation until 8 November 2023.

Recent news

EDPB picks topic for 2024 Coordinated Action

During its October plenary, the EDPB selected the topic for its third coordinated enforcement action, which will concern the implementation of the right of access by controllers. Further work will now be carried out to specify the details in the upcoming months and...

read more

September plenary – adopted documents

During its September plenary, the EDPB adopted: EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 19 September...

read more