In its recent plenary session, the European Data Protection Board (EDPB) approved Guidelines focusing on Article 37 of the Law Enforcement Directive (LED). These guidelines offer practical insights into the application of Article 37 LED, specifically addressing the transfer of personal data by competent authorities within EU countries to third-country authorities or international organizations in the realm of law enforcement.
The primary goal of these guidelines is to bring clarity to the legal standards for appropriate safeguards under Article 37(1)(a) and (b) LED. They also aim to assist EU countries when creating or modifying transfer instruments under Article 37(a) LED. Additionally, the guidelines provide direction to national data protection authorities (DPAs) involved in negotiating or reviewing such instruments, emphasizing their role in ensuring accountability according to Article 37(2) and (3) LED.
Key points highlighted in the guidelines include the insistence on maintaining an essentially equivalent level of protection for personal data in recipient third countries or international organizations. The guidelines caution against any transfers that might compromise the high level of protection applicable within the EU. A distinction is made between the use of a legally binding instrument (Article 37(a) LED) and an assessment by a controller (Article 37(b) LED), stressing that the latter should only be employed after a thorough analysis of the relevant legal framework and practices ensuring appropriate safeguards.
Moreover, the guidelines offer practical guidance, including a list of elements to address in a legally binding instrument and examples for categorizing and assessing transfer circumstances. These guidelines reflect the EDPB’s commitment to providing a robust framework for navigating complex data transfers in the context of law enforcement.
DELTA Data Protection & Compliance Academy & Consulting – info@delta-compliance.com
