Guidelines 02/2018 on Derogations of Article 49 GDPR

Section 2.2  Transfer necessary for the performance of a contract between the data subject and the controller or for the implementation of precontractual measures taken at the data subject’s request -(49 (1) (b))

In view of recital 111, data transfers on the grounds of this derogation may take place “where the transfer is occasional and necessary in relation to a contract (…)”

In general, although the derogations relating to the performance of a contract may appear to be potentially rather broad, they are being limited by the criterions of “necessity” and of “occasional transfers”.

Necessity of the data transfer

The “necessity test” limits the number of cases in which recourse can be made to Article 49 (1) (b). It requires a close and substantial connection between the data transfer and the purposes of the contract.

This derogation cannot be used for example when a corporate group has, for business purposes, centralized its payment and human resources management functions for all its staff in a third country as there is no direct and objective link between the performance of the employment contract and such transfer. Other grounds for transfer as provided for in Chapter V such as standard contractual clauses or binding corporate rules may, however, be suitable for the particular transfer.

On the other hand, the transfer by travel agents of personal data concerning their individual clients to hotels or to other commercial partners that would be called upon in the organization of these clients’ stay abroad can be deemed necessary for the purposes of the contract entered into by the travel agent and the client, since, in this case, there is a sufficientclose and substantial connection between the data transfer and the purposes of the contract (organization of clients’ travel).

This derogation cannot be applied to transfers of additional information not necessary for the performance of the contractor, respectively, for the implementation of precontractual measures requested by the data subject; for additional data other tools would hence be required.

Occasional transfers

Personal data may only be transferred under this derogation when this transfer is occasional. It would have to be established on a case by case basis whether data transfers or a data transfer would be determined as “occasional” or “non-occasional”.

A transfer here may be deemed occasional for example if personal data of a sales manager, who in the context of his/her employment contract travels to different clientsin third countries, are to be sent to those clients in order to arrange the meetings. A transfer could also be considered as occasional if a bank in the EU transfers personal data to a bank in a third country in order to execute a client’s request for making a payment, as long as this transfer does not occur in the framework of a stable cooperation relationship between the two banks.

On the contrary, transfers would not qualify as “occasional” in a case where a multi-national company organises trainings in a training centre in a third country and systematically transfers the personal data of those employees that attend a training course (e.g. data such as name and job title, but potentially also dietary requirements or mobility restrictions). Data transfers regularly occurring within a stable relationship would be deemed as systematic and repeated, hence exceeding an “occasional” character. Consequently, in this case many data transfers within a business relationship may not be based on Article49 (1) (b).

According to Article 49 (1) (3), this derogation cannot apply to activities carried out by public authorities in the exercise of their public powers.