Guidelines 02/2018 on Derogations of Article 49 GDPR

Section 2.1  The data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards -Article (49 (1) (a))

The general conditions for consent to be considered as valid are defined in Articles 4 (11) and 7 of the GDPR . The WP29 provides guidance on these general conditions for consent in a separate document, which is endorsed by the EDPB. These conditions also apply to consent in the context of Article 49 (1) (a). However,there are specific, additional elements required for consent to be considered a valid legal ground for international data transfers to third countries and international organizations as provided for in Article 49 (1) (a), and this document will focus on them.

Therefore, this section (2.1) of the present guidelines shall be read in conjunction with the WP29 guidelines on consent, endorsed by the EDPB, which provide a more detailed analysis on the interpretation of the general conditions and criteria of consent under the GDPR. It should also be noted that, according to Article 49 (3), public authorities are not able to rely on this derogation in the exercise of their public powers.

Article 49 (1) (a) states that a transfer of personal data to a third country or an international organization may be made in the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, on the condition that ‘the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards’.