Derogations under Article 49 are exemptions from the general principle that personal data may only be transferred to third countries if an adequate level of protection is provided for in the third country or if appropriate safeguards have been adduced and the data subjects enjoy enforceable and effective rights in order to continue to benefit from their fundamental rights and safeguards.
These derogations shall therefore only be used in specific situations: controllers or processors should first endeavour to apply one of the above-mentioned appropriate safeguards. Only in the absence of such appropriate safeguards, can controllers or processors use one of the derogations set out in Article 49 of the GDPR, and should be able to demonstrate why it was not possible to rely on appropriate safeguards, as required by the ‘accountability’ principle.
Based on the derogations, the personal data can be transferred where:
- the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;
- the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request;
- the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;
- the transfer is necessary for important reasons of public interest;
- the transfer is necessary for the establishment, exercise or defence of legal claims;
- the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; or
- the transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or Member State law for consultation are fulfilled in the particular case.
As a « last resort » derogation, personal data can be transferred if it is necessary for the purposes of the compelling legitimate interests pursued by the data exporter. However, this derogation only applies under a number of specific, expressly enumerated conditions:
- none of the above-mentioned derogations is applicable,
- the transfer is not repetitive,
- the transfer concerns only a limited number of data subjects,
- the transfer is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject,
- the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that assessment provided suitable safeguards with regard to the protection of personal data,
- the controller has informed the supervisory authority (e.g. the CNPD) of the transfer, and
- the controller has informed the data subject of the transfer and on the compelling legitimate interests pursued, in addition to providing the information referred to in articles 13 and 14 of the GDPR.