white_paper_on_data_protection_in_india_171127_final_v2

To facilitate the cross-border transfers of data, the EU has created three mechanisms. These
include the ‗adequacy test‘ as set out under Article 45 of the EU GDPR, 322 Model Contractual
Clauses 323 and Binding Corporate Rules (BCR). 324 Additionally, cross-border transfers of data
between the EU and the US is done by way of the Privacy Shield Framework. Each of these
will be discussed in greater detail below.
In the following section we provide an analysis of the various sets of data protection and
transfer laws that are applicable across the globe.
(i)
Adequacy Test
Article 45 of the EU GDPR 325 provides for an adequacy test for transfer of personal data to a
third country. This test stipulates that personal data of EU subjects to non-European
Economic Area or EEA countries is not permitted unless those countries are deemed to have
an ―adequate‖ level of data protection. While making this decision, the European
Commission will examine whether the country to which data is intended to be transferred has
data protection rules in place; whether they have effective and enforceable data protection
rights and their effective administration; whether independent data protection supervisory
authorities exist, who are vested with the power to ensure compliance; and finally, whether
the country in question has entered into any international commitments with regard to data
protection. Moreover, a periodic review of the adequacy standard must take place every four
years. 326
Under this provision, when assessing ―the adequacy of the level of protection‖, the European
Commission will take account of ―rules for the onward transfer of personal data to another
third country or international organization.‖ 327 Further, this article allows transfers of personal
data to third countries which do not have adequate data protection without the appropriate
safeguards for the transfers as listed in Article 49, 328 if such transfer is necessary for
important reasons of public interest.
Article 46 of the EU GDPR provides that if the European Commission has not made a
decision with regard to the adequacy level of another country, a controller may transfer
personal data only if appropriate safeguards are provided, and on condition that enforceable
data subject rights and effective legal remedies for data subjects are available. 329 Appropriate
safeguards can include (a) a legally binding and enforceable instrument between public
authorities or bodies; (b) binding corporate rules in accordance with Article 47; (c) standard
322 Article 45, EU GDPR.
323 European Commission, ‗Model Contracts for the Transfer of Personal Data to Third Countries‘, available at:
http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm (last accessed 30
October 2017).
324 European Commission, ‗Overview on Binding Corporate Rules‘, available at: http://ec.europa.eu/justice/dataprotection/international-transfers/binding-corporate-rules/index_en.htm
(last accessed 30 October 2017).
325 Article 45, EU GDPR.
326 Article 45(3), EU GDPR.
327 Article 45(2)(a), EU GDPR.
328 Article 49, EU GDPR.
329 Article 46, EU GDPR.
63