Show the recitals of the Regulation related to article 48 keyboard_arrow_down
Hide the recitals of the Regulation related to article 48 keyboard_arrow_up
(115) Some third countries adopt laws, regulations and other legal acts which purport to directly regulate the processing activities of natural and legal persons under the jurisdiction of the Member States. This may include judgments of courts or tribunals or decisions of administrative authorities in third countries requiring a controller or processor to transfer or disclose personal data, and which are not based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State. The extraterritorial application of those laws, regulations and other legal acts may be in breach of international law and may impede the attainment of the protection of natural persons ensured in the Union by this Regulation. Transfers should only be allowed where the conditions of this Regulation for a transfer to third countries are met. This may be the case, inter alia, where disclosure is necessary for an important ground of public interest recognised in Union or Member State law to which the controller is subject.
There is no recital in the Directive related to article 48.
The GDPR
The final version of the Regulation introduces a new Article 48 under which a judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognized or enforceable if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State.
In the absence of an international agreement in force, no judgment or decision from outside the EU require a transfer of personal data.
This provision does not affect transfers of data which would be carried out on another basis provided for in chapter V of the Regulation.
The Directive
The Directive included no similar provision.
Potential issues
The EU seems here to legalize its doctrine resulting from the Swift case. Even though having no powers over foreign jurisdictions and foreign administrative authorities, the EU puts controllers and processors established in Europe in breach of the Regulation as soon as they submit themselves to foreign orders. We guess that the goal is more political than legal.
