DATA PROTECTION | EDPB issues new guidelines on international personal data transfers to local authorities

On 3 December 2024, the European Data Protection Board (“EDPB”) published Guidelines 02/2024 on Article 48 GDPR (Guidelines), which are now open for public consultation until 27 January 2025. The Guidelines clarify the rules for international transfers of personal data outside the European Economic Area (EEA), when requested by authorities of third countries. According to Chapter V of the GDPR, data transfers outside the EEA are only allowed if the recipient country benefits from an adequacy decision by the European Commission or if adequate safeguards have been implemented in accordance with Article 46 of the GDPR. Article 48 GDPR further provides that such requests can only be recognised if they are based on a valid international agreement, such as a mutual legal assistance treaty. In this context, the purpose of the Guidelines is to clarify the rationale and purpose of Article 48 GDPR, including its interaction with other provisions of the GDPR, in particular Article 6 and Chapter V, and to provide practical recommendations to EU controllers and processors who may receive requests from third country authorities to disclose or transfer personal data.

Newsletter n. 102 – December 2024