argomento: News del mese - Diritto Internazionale e Comunitario

Articoli Correlati: Data - GDPR - Guidelines on Codes of Conduct

On 22^nd of February 2022, the European Data Protection Board adopted version 2.0 of its Guidelines 04/2021 on Codes of Conduct as tools for transfers of personal data, as an harmonized European framework to demonstrate the accountability and as an appropriate safeguard. The GDPR provides that “any transfers of personal data to third countries or international organisations shall take place only if the conditions laid down in this Regulation under articles 44 and follows of the GDPR are complied with by the controller and processor”. In the absence of an adequacy decision, a controller or a processor may transfer personal data to a third country or an international organisation only if there are appropriate safeguards. To this aim, controllers/processors shall make binding and enforceable commitments using a contract or other legally binding instruments, wherewith there are able to demonstrate the binding and enforceable nature in accordance with EU and to be binding and enforceable by data subjects as third-party beneficiaries. These guidelines complement the EDPB Guidelines 1/2019 on “codes of Conduct and Monitoring Bodies under Regulation 2016/679” and provide practical guidance on the content of such codes of conduct, their adoption process with flow charts and the actors involved. These guidelines are very important for all sectors of the market given the wide application of all the code of conduct could ensure the accountability to GDPR by the code owner and ensure the compliance, in particular, with the obligations for transfers of personal data and in order to provide the consistency level of protection of personal data outside EEA according to CJEU Schrems II ruling. In fact, in light of ensuring an appropriate safeguards as transfer tools, these guidelines provide a check-list of the elements to be covered by a code of conduct intended for transfers.