The European Data Protection Board has adopted the following statement: As the EDPB/national Supervisory Authorities have been receiving questions about the exchange of personal data between public authorities under existing international agreements in different areas, the EDPB wishes to recall the requirements of Article 96 GDPR and Article 61 Law Enforcement Directive (LED).
According to those provisions, all international agreements involving the transfer of personal data to third countries or international organisations which were concluded by the EU Member States prior to 24 May 2016 or 6 May 2016 respectively, and which comply with Union law as applicable prior to that date, shall remain in force until amended, replaced or revoked. The EDPB deems that, in order to ensure that the level of protection of natural persons guaranteed by the GDPR and the LED is not undermined when personal data is transferred outside the Union, consideration should be given to the aim of bringing these agreements in line with the GDPR and LED requirements for data transfers where this is not yet the case.
The EDPB therefore invites the Member States to assess and, where necessary, review their international agreements that involve international transfers of personal data, such as those relating to taxation (e.g. to the automatic exchange of personal data for tax purposes), social security, mutual legal assistance, police cooperation, etc. which were concluded prior to 24 May 2016 (for the agreements relevant to the GDPR) or 6 May 2016 (for the agreements relevant to the LED).
This review should be done in order to determine whether, while pursuing the important public interests covered by the agreements, further alignment with current Union legislation and case law on data protection, as well as EDPB guidance might be needed. 2 Adopted The EDPB recommends that Member States take into account for this review the GDPR and LED themselves, the relevant EDPB guidelines applicable to international transfers, as well as the case-law of the European Court of Justice, including the Schrems II judgment of 16 July 20201 . In particular, the EDPB issued Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies2 in December 2020. These guidelines set forth the standard under the GDPR regarding safeguards to be included in legally binding instruments or administrative arrangements between public bodies.
The EDPB has also included in its work programme for 2021-20223 specific guidance on the safeguards to be included in legally binding instruments pursuant to Article 37(1)(a) LED. National Supervisory Authorities (Article 51 GDPR and Article 41 LED) are available to assist Member States in this process. For the European Data Protection Board The Chair (Andrea Jelinek)
