In what cases it will not be required to obtain GIODO’s consent – by way of administrative decision - to data transfer?
The consent will not be required in case where the data controller ensures adequate protection of data through:
- standard contractual clauses of personal data protection approved by the European Commission;
- legally binding rules or policies of personal data protection, so called binding corporate rules.
It will be possible to use standard contractual clauses approved by the European Commission in line with Art. 26 paragraph 4 of the Directive 95/45/EC in contracts with entities from third countries. The European Commission issued three decisions in this regard:
- Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 181, 4.7.2001). Standard contractual clauses introduced by this decision apply to the transfer of personal data to the data controller in a third country. The English version of the Decision is available at: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32001D0497&from=en
- Commission Decision 2004/915/EC of 27 December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries (OJ L 385/19, of 29.12.2004). The above decision introduced an alternative set of contractual clauses, which can be used by the data controller in case of data transfer to another data controller in a third country. The English version of the Decision is available at: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2004:385:0074:0084:en:PDF
- Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (OJ L 39 p. 5 of 12.02.2010). Standard contractual clauses introduced by the above Decision apply to personal data transfers in case of commissioning of personal data processing within the meaning of Art. 31 of the Act on the Protection of Personal Data.
The English version of the Decision is available at: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:EN:PDF
Whereas the binding corporate rules will apply to entities belonging to the same group of entrepreneurs (the same group of companies). Binding corporate rules can be applied after they have been approved by GIODO (by way of administrative decision), after conducting optional consultations with personal data protection authorities of EEA countries, in the territory of which the entrepreneurs belonging to the above group are established. In case where binding corporate rules were subject of a decision issued by a data protection authority, GIODO can take them into account.


