These guidelines provide guidance on the application of Article 37 LED, in particular on the legal standard for appropriate safeguards to be applied by competent authorities pursuant to Article 37(1)(a) and (b) LED and, accordingly, on the relevant factors for the assessment of whether such safeguards exist. These guidelines therefore include an indication as to the EDPB’s expectations of Member States, as negotiating parties, when envisaging concluding or amending a legally binding instrument between the concerned Member State(s) and a third country or international organisation pursuant to Article 37(1)(a) LED.
The EDPB notes that Article 35(3) LED applies to transfers carried out under Article 37 LED. Article 37 LED should therefore be applied in light of the principle that the level of data protection applicable in the European Union must not be undermined by the transfer of personal data to another jurisdiction.
The EDPB concludes that Article 37 LED requires an essentially equivalent level of data protection in the recipient third country or international organisation. However, this requirement relates to the specific data transfer or category of transfers at hand. Pursuant to Article 37 LED, essential equivalence to the protection guaranteed under the LED should be ensured for that particular case and not necessarily with regard to the entire existing legislation in the third country or international organisation.
