Transfers from a public authority or body in the EEA to another public authority or body in a third country may take place:
- with a legally binding and enforceable instrument between public authorities or bodies, without requiring a prior authorisation from the CNPD,[1] or
- if a public authority or body does not have the power to enter into legally binding and enforceable arrangements, through administrative arrangements, which may be concluded between public authorities or bodies and which provide for enforceable and effective data subject rights and effective legal remedies, with a prior authorisation from the CNPD in accordance with the consistency mechanism set out in Article 63 of the GDPR.[2]
[1] Article 46, paragraph 2, letter a) of the GDPR.
[2] Article 46, paragraphs 3, letter b), and 4) of the GDPR.