The EDPB has adopted a final version of the recommendations on the additional measures after a public consultation which has found fore between interested parties.
After the Schrems II Judgement of the European Court of Justice, recommendations aim to help data controllers and processors which act as exporters of data, to define and adopt appropriate additional measures, where they are necessary in order to grant a equivalent level of personal data protection that they are shared to third countries.
Among the most important changes there are:
- The accent implemented on the importance to examine practices of public authorities of third countries in the juridical assessments of exporters for establishing if the legislation and or practices of the third countries interfere – in practice – with the effectiveness of the transfer tool of the article 46, paragraph 1 of the GDPR;
- The possibility that the exporter keeps in mind, in its assessment, of the practical experience of the importer; and
- The clarification according to also the legislation of the third country which permits to its authorities to have the access to personal data shared, also without the intervention of the importer, shall compromise the efficiency of the transfer tool.
SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DEL LUSSEMBRUGO