Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

Section 2.4  Rights of the data subjects

24. The international agreement must ensure enforceable and effective data subject rights as specified in article 46 (1) and recital 108 of the GDPR.

25. The rights available to the data subjects, including the specific commitments taken by the parties to provide for such rights, should be listed in the agreement. To be effective, the international agreement must provide for mechanisms that ensure their application in practice. Moreover, any breach of data subject rights must carry an appropriate remedy.

26. The international agreement can also provide for restrictions to the rights of data subjects. These restrictions should be in line with the restrictions envisaged by Article 23 GDPR. Such a restriction has to be a necessary and proportionate measure to safeguard important objectives, such as the rights and freedom of others, national security, defence or the prevention, investigation, detection or prosecution of criminal offences. It needs to be provided by law, and shall continue only for as long as the reason for the restriction continues to exist. Restrictions safeguarding important objectives of general public interest can only be approved if the public interest concerned is also recognised by the European Union or a Member State.