Guidelines 2/2020 on articles 46 (2) (a) and 46 (3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies

SECTION 2  GENERAL RECOMMENDATIONS FOR THE APPROPRIATE SAFEGUARDS UNDER BOTH ARTICLES 46 (2) (a) AND 46 (3) (b) GDPR

9. Unlike Article 26 (2) of the 95/46/EC Directive, Article 46 of the GDPR provides for additional appropriate safeguards as tools for transfers between public bodies:

   (i) a legally binding and enforceable instrument, Article 46  (2) (a) GDPR or (ii) provisions to be inserted into administrative arrangements, Article 46 (3) (b) GDPR.

These instruments and arrangements may be of bilateral or multilateral nature.

10. The following section provides some general recommendations to help ensure that legally binding instruments or administrative arrangements (hereinafter “international agreements”) between public bodies are in compliance with the GDPR.

11. Taking into account Article 44 of the GDPR and the fact that Article 46 and recital 108 of the GDPR do not provide specific indications on the guarantees to be included in such international agreements, the EDPB hereby has elaborated a list of minimum safeguards to be included in international agreements between public bodies falling under Articles 46 (2) (a) or 46 (3) (b) GDPR. These safeguards aim to ensure that the level of protection of natural persons under the GDPR is not undermined when their personal data is transferred outside of the EEA.