AI Summary of Article 36 Transfers on the basis of an adequacy decision
Member States are required to ensure that transfers of personal data to third countries or international organisations only occur if the European Commission determines that an adequate level of protection is in place. This process requires consideration of various factors, including the rule of law, human rights, relevant legislation, the effectiveness of data protection enforcement, and the existence of independent supervisory authorities. The Commission must evaluate these criteria and periodically review its decisions on adequacy every four years.
If it is found that a third country or organisation no longer ensures adequate protection, the Commission has the authority to repeal, amend, or suspend the decision through implementing acts. Urgent situations may allow for immediate implementations without retroactive effect. Finally, the Commission must publish a list of third countries and organisations with current adequacy determinations in the Official Journal of the European Union.
Article 36 Transfers on the basis of an adequacy decision
1. Member States shall provide that a transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. Such a transfer shall not require any specific authorisation.
2. When assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the following elements:
(a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral, including concerning public security, defence, national security and criminal law and the access of public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures, including rules for the onward transfer of personal data to another third country or international organisation, which are complied with in that country or international organisation, case-law, as well as effective and enforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal data are transferred;