Transfer of data to third countries relating to criminal convictions of third-country nationals for the purposes of return, readmission and reintegration
Article 38
1. Data relating to one or more criminal convictions of a third-country national may be processed and transferred in individual cases by a competent authority and, where applicable, Frontex, to a third country’s competent authority or third parties competent for reintegration assistance or other tasks related to implementing the return where the following conditions are met: (a) the third-country national whose personal data is transferred has been convicted in the previous 25 years of a terrorist offence or in the previous 15 years of any other criminal offence listed in the Annex to Regulation (EU) 2018/1240 of the European Parliament and of the Council ( 36 ) or has committed an offence carrying a penalty involving the deprivation of liberty of at least two years under national law or has committed multiple offences carrying a penalty involving the deprivation of liberty of at least one year under the national law of the convicting Member State; (b) the transfer of data is necessary for the purposes of return, readmission, or providing tailor-made non-financial reintegration assistance; (c) the competent authority has verified and, where applicable, Frontex is satisfied that the transfer of data does not risk violating the principle of non-refoulement; (d) the competent authority has verified and, where applicable, Frontex is satisfied that the transfer of data does not risk violating Article 50 of the Charter. 2. Where Member States and Frontex transfer personal data pursuant to paragraph 1 of this Article, they shall ensure that such transfers comply with Chapter V of Regulation (EU) 2016/679 and Chapter V of Regulation (EU) 2018/1725, respectively. 3. Where a transfer is made pursuant to paragraph 1 of this Article, such a transfer shall be documented and the documentation shall, upon request, be made available to the competent supervisory authority established in accordance with Article 51(1) of Regulation (EU) 2016/679 and Article 52(1) of Regulation (EU) 2018/1725, including the date and time of the transfer, information about the receiving third country’s competent authority, the justification that the transfer complies with the conditions laid down in paragraph 1 of this Article and the personal data transferred. That documentation shall be limited to the information strictly necessary to demonstrate compliance with the legal basis for the transfer and shall not entail any additional reporting obligations for Member States.