SUVP (GDPR)
>
Člen 46. Prenosi, za katere se uporabljajo ustrezni zaščitni ukrepi
Člen 46 SUVP (GDPR). Prenosi, za katere se uporabljajo ustrezni zaščitni ukrepi
Article 46 GDPR. Transfers subject to appropriate safeguards
1. Kadar sklep v skladu s členom 45(3) ni sprejet, lahko upravljavec ali obdelovalec osebne podatke prenese v tretjo državo ali mednarodno organizacijo le, če je upravljavec ali obdelovalec predvidel ustrezne zaščitne ukrepe, in pod pogojem, da imajo posamezniki, na katere se nanašajo osebni podatki, na voljo izvršljive pravice in učinkovita pravna sredstva.
1. In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
2. Ustrezni zaščitni ukrepi iz odstavka 1 se lahko, ne da bi bilo potrebno posebno dovoljenje nadzornih organov, zagotovijo s:
2. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:
Uvodne izjave
(108) Če sklep o ustreznosti ni sprejet, bi moral upravljavec ali obdelovalec sprejeti ukrepe, na podlagi katerih pomanjkanje varstva podatkov v tretji državi nadomestijo z ustreznimi zaščitnimi ukrepi za posameznika, na katerega se nanašajo osebni podatki. Taki ustrezni zaščitni ukrepi so lahko sestavljeni iz uporabe zavezujočih poslovnih pravil, standardnih določil Komisije o varstvu podatkov, standardnih določil nadzornega organa o varstvu podatkov ali pogodbenih določil, ki jih je odobril nadzorni organ. S temi zaščitnimi ukrepi bi bilo treba zagotoviti skladnost z zahtevami glede varstva podatkov in pravicami posameznikov, na katere se nanašajo osebni podatki, ki ustrezajo obdelavi znotraj Unije, vključno z razpoložljivostjo izvršljivih pravic posameznikov, na katere se nanašajo osebni podatki, in učinkovitih pravnih sredstev, tudi pravico do učinkovitega upravnega ali sodnega varstva ali odškodnine, v Uniji ali tretji državi. Nanašati bi se morali zlasti na skladnost s splošnimi načeli v zvezi z obdelavo osebnih podatkov ter načeli vgrajenega in prevzetega varstva podatkov. Prenose z javnimi organi ali telesi v tretjih državah oziroma z mednarodnimi organizacijami z ustreznimi nalogami ali funkcijami lahko opravijo tudi javni organi ali telesa, tudi na podlagi določb, ki se vključijo v upravne dogovore, kot je memorandum o soglasju, s katerimi se zagotavljajo izvršljive in učinkovite pravice posameznikov, na katere se nanašajo osebni podatki. Kadar so zaščitni ukrepi določeni v upravnih dogovorih, ki niso pravno zavezujoči, bi bilo treba pridobiti dovoljenje pristojnega nadzornega organa.
(108) In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority. Those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default. Transfers may also be carried out by public authorities or bodies with public authorities or bodies in third countries or with international organisations with corresponding duties or functions, including on the basis of provisions to be inserted into administrative arrangements, such as a memorandum of understanding, providing for enforceable and effective rights for data subjects. Authorisation by the competent supervisory authority should be obtained when the safeguards are provided for in administrative arrangements that are not legally binding.
(109) Možnost, ki jo ima upravljavec ali obdelovalec glede uporabe standardnih določil Komisije ali nadzornega organa o varstvu podatkov, upravljavcem ali obdelovalcem ne bi smela preprečiti niti, da standardna določila o varstvu podatkov vključijo v obsežnejšo pogodbo, kot je pogodba med obdelovalcem in drugim obdelovalcem, niti da dodajo druga določila ali dodatne zaščitne ukrepe, če ti neposredno ali posredno ne nasprotujejo standardnim pogodbenim določilom Komisije ali nadzornega organa ali posegajo v temeljne pravice ali svoboščine posameznikov, na katere se nanašajo osebni podatki. Upravljavce in obdelovalce bi bilo treba spodbujati, da vzpostavijo dodatne zaščitne ukrepe s pomočjo pogodbenih obveznosti, ki bi dopolnjevale standardna zaščitna določila.
(109) The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should prevent controllers or processors neither from including the standard data-protection clauses in a wider contract, such as a contract between the processor and another processor, nor from adding other clauses or additional safeguards provided that they do not contradict, directly or indirectly, the standard contractual clauses adopted by the Commission or by a supervisory authority or prejudice the fundamental rights or freedoms of the data subjects. Controllers and processors should be encouraged to provide additional safeguards via contractual commitments that supplement standard protection clauses.
(c) standardnimi določili o varstvu podatkov, ki jih sprejme Komisija v skladu s postopkom pregleda iz člena 93(2);
(c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 93(2);
Smernice in sodna praksa
Povezana besedila
EU controller to non-EU or EEA controller
EU controller to non-EU or EEA processor
(d) standardnimi določili o varstvu podatkov, ki jih sprejme nadzorni organ in odobri Komisija v skladu s postopkom pregleda iz člena 93(2);
(d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);
(e) odobrenim kodeksom ravnanja v skladu s členom 40, skupaj z zavezujočimi in izvršljivimi zavezami upravljavca ali obdelovalca v tretji državi, da bo uporabljal ustrezne zaščitne ukrepe, tudi glede pravic posameznikov, na katere se nanašajo osebni podatki, ali
(e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights; or
(f) odobrenim mehanizmom potrjevanja v skladu s členom 42, skupaj z zavezujočimi in izvršljivimi zavezami upravljavca ali obdelovalca v tretji državi, da bo uporabljal ustrezne zaščitne ukrepe, tudi glede pravic posameznikov, na katere se nanašajo osebni podatki.
(f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights.
3. Ustrezni zaščitni ukrepi iz odstavka 1 se lahko z dovoljenjem ustreznega nadzornega organa zagotovijo tudi zlasti s:
3. Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:
(a) pogodbenimi določili med upravljavcem ali obdelovalcem in upravljavcem, obdelovalcem ali uporabnikom osebnih podatkov v tretji državi ali mednarodni organizaciji, ali
(a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or
(b) določbami, ki se vstavijo v upravne dogovore med javnimi organi ali telesi in v katere so vključene izvršljive in učinkovite pravice za posameznike, na katere se nanašajo podatki.
(b) provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.
5. Dovoljenja države članice ali nadzornega organa na podlagi člena 26(2) Direktive 95/46/ES ostanejo veljavna, dokler jih zadevni nadzorni organ ne spremeni, nadomesti ali razveljavi, če je to potrebno. Odločitve, ki jih je Komisija sprejela na podlagi člena 26(4) Direktive 95/46/ES, ostanejo veljavne, dokler jih Komisija ne spremeni, nadomesti ali razveljavi, če je to potrebno, z odločitvijo, sprejeto v skladu z odstavkom 2 tega člena.
5. Authorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC shall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by the Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or repealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article.
Splošna uredba o varstvu podatkov (SUVP, GDPR)
General Data Protection Regulation (EU GDPR)
The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.
ISO 27701
Uvodne izjave
Smernice in sodna praksa
Pustite komentar
(108) Če sklep o ustreznosti ni sprejet, bi moral upravljavec ali obdelovalec sprejeti ukrepe, na podlagi katerih pomanjkanje varstva podatkov v tretji državi nadomestijo z ustreznimi zaščitnimi ukrepi za posameznika, na katerega se nanašajo osebni podatki. Taki ustrezni zaščitni ukrepi so lahko sestavljeni iz uporabe zavezujočih poslovnih pravil, standardnih določil Komisije o varstvu podatkov, standardnih določil nadzornega organa o varstvu podatkov ali pogodbenih določil, ki jih je odobril nadzorni organ. S temi zaščitnimi ukrepi bi bilo treba zagotoviti skladnost z zahtevami glede varstva podatkov in pravicami posameznikov, na katere se nanašajo osebni podatki, ki ustrezajo obdelavi znotraj Unije, vključno z razpoložljivostjo izvršljivih pravic posameznikov, na katere se nanašajo osebni podatki, in učinkovitih pravnih sredstev, tudi pravico do učinkovitega upravnega ali sodnega varstva ali odškodnine, v Uniji ali tretji državi. Nanašati bi se morali zlasti na skladnost s splošnimi načeli v zvezi z obdelavo osebnih podatkov ter načeli vgrajenega in prevzetega varstva podatkov. Prenose z javnimi organi ali telesi v tretjih državah oziroma z mednarodnimi organizacijami z ustreznimi nalogami ali funkcijami lahko opravijo tudi javni organi ali telesa, tudi na podlagi določb, ki se vključijo v upravne dogovore, kot je memorandum o soglasju, s katerimi se zagotavljajo izvršljive in učinkovite pravice posameznikov, na katere se nanašajo osebni podatki. Kadar so zaščitni ukrepi določeni v upravnih dogovorih, ki niso pravno zavezujoči, bi bilo treba pridobiti dovoljenje pristojnega nadzornega organa.
(108) In the absence of an adequacy decision, the controller or processor should take measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority. Those safeguards should ensure compliance with data protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default. Transfers may also be carried out by public authorities or bodies with public authorities or bodies in third countries or with international organisations with corresponding duties or functions, including on the basis of provisions to be inserted into administrative arrangements, such as a memorandum of understanding, providing for enforceable and effective rights for data subjects. Authorisation by the competent supervisory authority should be obtained when the safeguards are provided for in administrative arrangements that are not legally binding.
(109) Možnost, ki jo ima upravljavec ali obdelovalec glede uporabe standardnih določil Komisije ali nadzornega organa o varstvu podatkov, upravljavcem ali obdelovalcem ne bi smela preprečiti niti, da standardna določila o varstvu podatkov vključijo v obsežnejšo pogodbo, kot je pogodba med obdelovalcem in drugim obdelovalcem, niti da dodajo druga določila ali dodatne zaščitne ukrepe, če ti neposredno ali posredno ne nasprotujejo standardnim pogodbenim določilom Komisije ali nadzornega organa ali posegajo v temeljne pravice ali svoboščine posameznikov, na katere se nanašajo osebni podatki. Upravljavce in obdelovalce bi bilo treba spodbujati, da vzpostavijo dodatne zaščitne ukrepe s pomočjo pogodbenih obveznosti, ki bi dopolnjevale standardna zaščitna določila.
(109) The possibility for the controller or processor to use standard data-protection clauses adopted by the Commission or by a supervisory authority should prevent controllers or processors neither from including the standard data-protection clauses in a wider contract, such as a contract between the processor and another processor, nor from adding other clauses or additional safeguards provided that they do not contradict, directly or indirectly, the standard contractual clauses adopted by the Commission or by a supervisory authority or prejudice the fundamental rights or freedoms of the data subjects. Controllers and processors should be encouraged to provide additional safeguards via contractual commitments that supplement standard protection clauses.
(EN)
Documents
EDPS, Strategy for Union institutions, offices, bodies and agencies to comply with the ‘Schrems II’ Ruling (2020).
This document seeks to provide guidance as to the application of Articles 46 (2) (a) and 46 (3) (b) of the General Data Protection Regulation (GDPR) on transfers of personal data from EEA public authorities or bodies to public bodies in third countries or to international organisations, to the extent that these are not covered by an adequacy finding adopted by the European Commission.
EDPB, Government access to data in third countries (2022).
Case law
CJEU, Data Protection Commissioner/Facebook Ireland Ltd and Schrems, C-311/18 (2020).
[js-disqus]
(EN) Url-link to highlighted text was copied to the clipboard!
(EN) Preparing download...
(EN) ISO/IEC 27701, adopted in 2019, added additional ISO/IEC 27002 guidance for PII controllers.
Here is the relevant paragraph to article 46 GDPR:
7.5.1 Identify basis for PII transfer between jurisdictions
Control
The organization should identify and document the relevant basis for transfers of PII between jurisdictions.
Implementation guidance
PII transfer can be subject to legislation and/or regulation depending on the jurisdiction or international organization to which data is to be transferred (and from where it originates).
(EN) […]
(EN) Sign in
to read the full text