Transmission of operational personal data to Union institutions, bodies, offices and agencies
1. Subject to any further restrictions pursuant to this Regulation, in particular pursuant to Articles 21(8), 47(5) and 76, Eurojust shall only transmit operational personal data to another Union institution, body, office or agency if the data are necessary for the legitimate performance of tasks covered by the competence of the other Union institution, body, office or agency.
2. Where the operational personal data are transmitted following a request from another Union institution, body, office or agency, both the controller and the recipient shall bear the responsibility for the legitimacy of that transfer.
Eurojust shall be required to verify the competence of the other Union institution, body, office or agency and to make a provisional evaluation of the necessity of the transmission of the operational personal data. If doubts arise as to this necessity, Eurojust shall seek further information from the recipient.
The other Union institution, body, office or agency shall ensure that the necessity of the transmission of the operational personal data can be subsequently verified.
3. The other Union institution, body, office or agency shall process the operational personal data only for the purposes for which they were transmitted.
General principles for transfers of operational personal data to third countries and international organisations
1. Eurojust may transfer operational personal data to a third country or international organisation, subject to compliance with the applicable data protection rules and the other provisions of this Regulation, and only where the following conditions are met:
(a)
the transfer is necessary for the performance of Eurojust’s tasks;
(b)
the authority of the third country or the international organisation to which the operational personal data are transferred is competent in law enforcement and criminal matters;
(c)
where the operational personal data to be transferred in accordance with this Article have been transmitted or made available to Eurojust by a Member State, Eurojust shall obtain prior authorisation for the transfer from the relevant competent authority of that Member State in compliance with its national law, unless that Member State has authorised such transfers in general terms or subject to specific conditions;
(d)
in the case of an onward transfer to another third country or international organisation by a third country or international organisation, Eurojust shall require the transferring third country or international organisation to obtain the prior authorisation of Eurojust for that onward transfer.
Eurojust shall only provide authorisation under point (d) with the prior authorisation of the Member State from which the data originate after taking due account of all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data were originally transferred and the level of personal data protection in the third country or international organisation to which the operational personal data are to be transferred onward.
2. Subject to the conditions set out in paragraph 1 of this Article, Eurojust may transfer operational personal data to a third country or to an international organisation only where one of the following applies:
(a)
the Commission has decided pursuant to Article 57 that the third country or international organisation in question ensures an adequate level of protection, or in the absence of such an adequacy decision, appropriate safeguards have been provided for or exist in accordance with Article 58(1), or in the absence of both an adequacy decision and of such appropriate safeguards, a derogation for specific situations applies pursuant to Article 59(1);
(b)
a cooperation agreement allowing for the exchange of operational personal data has been concluded before 12 December 2019 between Eurojust and that third country or international organisation, in accordance with Article 26a of Decision 2002/187/JHA; or
(c)
an international agreement has been concluded between the Union and the third country or international organisation pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
3. The working arrangements referred to in Article 47(3) may be used to set out modalities to implement the agreements or adequacy decisions referred to in paragraph 2 of this Article.
4. Eurojust may in urgent cases transfer operational personal data without prior authorisation from a Member State in accordance with point (c) of paragraph 1. Eurojust shall only do so if the transfer of the operational personal data is necessary for the prevention of an immediate and serious threat to the public security of a Member State or of a third country or to the essential interests of a Member State, and where the prior authorisation cannot be obtained in good time. The authority responsible for giving prior authorisation shall be informed without delay.
5. Member States and Union institutions, bodies, offices and agencies shall not transfer operational personal data they have received from Eurojust onward to a third country or an international organisation,. As an exception, they may make such a transfer in cases where Eurojust has authorised it after taking into due account all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data were originally transmitted and the level of personal data protection in the third country or international organisation to which the operational personal data are transferred onward.
6. Articles 57, 58 and 59 shall apply in order to ensure that the level of protection of natural persons ensured by this Regulation and by Union law is not undermined.
Transfers on the basis of an adequacy decision
Eurojust may transfer operational personal data to a third country or to an international organisation where the Commission has decided in accordance with Article 36 of Directive (EU) 2016/680 that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.
Transfers subject to appropriate safeguards
1. In the absence of an adequacy decision, Eurojust may transfer operational personal data to a third country or an international organisation where:
(a)
appropriate safeguards with regard to the protection of operational personal data are provided for in a legally binding instrument; or
(b)
Eurojust has assessed all the circumstances surrounding the transfer of operational personal data and has concluded that appropriate safeguards exist with regard to the protection of operational personal data.
2. Eurojust shall inform the EDPS about categories of transfers under point (b) of paragraph 1.
3. When a transfer is based on point (b) of paragraph 1, such a transfer shall be documented and the documentation shall be made available to the EDPS on request. The documentation shall include a record of the date and time of the transfer and information about the receiving competent authority, about the justification for the transfer and about the operational personal data transferred.
Derogations for specific situations
1. In the absence of an adequacy decision, or of appropriate safeguards pursuant to Article 58, Eurojust may transfer operational personal data to a third country or an international organisation only on the condition that the transfer is necessary:
(a)
in order to protect the vital interests of the data subject or another person;
(b)
to safeguard legitimate interests of the data subject;
(c)
for the prevention of an immediate and serious threat to public security of a Member State or a third country; or
(d)
in individual cases for the performance of the tasks of Eurojust, unless Eurojust determines that the fundamental rights and freedoms of the data subject concerned override the public interest in the transfer.
2. Where a transfer is based on paragraph 1, such a transfer shall be documented and the documentation shall be made available to the EDPS on request. The documentation shall include a record of the date and time of the transfer, and information about the receiving competent authority, about the justification for the transfer and about the operational personal data transferred.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
