Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679
Paragraph 3.2.3 Risks to free flow of personal data within the Union
44. Where the objection will refer to this particular risk, the CSA will need to clarify why it is deemed to be “applicable”. Additionally, an objection demonstrating risks posed to the free flow of personal data, but not to the rights and freedoms of data subjects, will not be considered as meeting the threshold set by Article 4 (24) GDPR.
45. The need to avoid restricting or prohibiting the free movement of personal data for reasons connected with the protection of natural persons with regard to the processing of personal data is explicitly recalled by the GDPR, which aims to introduce harmonised data protection rules across the EU and enable the free flow of personal data within the Union, while ensuring a high level of the protection of personal data.
46. The risks to the free flow of data may be created by any measures, including decisions of national SAs, which introduce unjustified limitations regarding data storage (e.g. provisions which oblige a controller to store certain information in a particular Member State) and/or the free flow of personal data between the Member States (e.g. through suspension of data flows or imposition of temporary or definitive limitation including a ban on processing).
47. Likewise, the free flow of data may be at risk when expectations are set (or requirements imposed) on how controllers fulfil their obligations under the GDPR, namely in such a way that it becomes tied to a specific region in the EU (e.g. through language requirements, specific qualifications requirements).
48. Additionally, the free flow of personal data may also be hampered if unjustifiably different decisions are issued by SAs in situations that are identical or similar (e.g. in terms of sector or type of processing); this lack of uniformity would endanger the EU level playing field and create contradictory situations within the EU and the risk of forum shopping.