European Data Protection Board Guidance On Derogations For International Data Transfers

On 25 May 2018, the European Data Protection Board (the "EDPB") adopted its "Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679" with regard to international data transfers (the "Guidelines").

Derogations Are Last Resort

Under Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), the general rule is that data can only be transferred to non-EEA countries if these countries offer an "adequate level of protection". The existence of an adequate level of protection can either follow from an adequacy decision issued by the European Commission, or be a consequence of specific measures taken by the data controller, i.e., if the data controller has put in place "adequate safeguards" such as the implementation of binding corporate rules or the use of standard model clauses. Article 49 of