EDPB Publishes Guidelines 02/2024 post-consultation version 2.1 on Article 48 GDPR

The EDPB considered it relevant to clarify on key terminology of Art. 48 GDPR. 

• Judgment / Decision: “The EDPB finds that the terminology used by the third country body to qualify its request as a “decision” or “judgment” is not decisive for the application of Article 48, as long as it is an official request from a third country authority.”
• Authority / Court / Tribunal: Similar to the broad understanding of Judgment/Decision, the EDPB seems to tend to a broad understanding of Authority / Court / Tribunal, provided that such body is provided with related powers by third country law where it resides. "Requests from third country authorities issued in different contexts and for different purposes would fall within the scope of the provision e.g. requests from law enforcement or national security authorities, financial regulators or public authorities responsible for approving pharmaceutical products, medical devices, etc."
• International Agreement: In consideration of Art. 46.2 lit a) GDPR, the EDPB understand international agreement as “a legally binding and enforceable instrument between public authorities or bodies”. Such agreement may provide for either direct request public-to-private or for cooperation obligation public-to-public, subsequently affecting private. MLATs usually reflect the latter option. whereas vice versa MLATs do not necessarily comply with the requirements as of Art. 46.2 lit a) GDPR.

The EDPB notes that “Art. 48 GPDR applies in situations where a controller or processor in the EU receives a decision or judgment from an administrative authority or a court in a third country requiring the transfer or disclosure of personal data.” By governing the access to GDPR-protected personal data by non-EU courts and authorities, Art. 48 GDPR enshrines the European Union level of protection of individuals. 

Regardless of the means of access, by hard or virtual copy or by means of remote access, this qualifies as transfer under Chapter V GDPR. Art. 48 GDPR uses “transfer and disclosure”. Disclosure is one exemplary element of the meaning of processing under Art. 4.2. GDPR. The EDPB refers to its Guidelines 05/2021 by which it was already noted that the means of access shall not affect the legal concept of a third country transfer. 

The EDPB also notes that Art. 48 GDPR does not impose any limitations in respect of the intended processing purposes of the requesting authority or court. 

Where the transfer of personal data is not subject to a request by a third country court or authority, or where the request is not based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, such transfer is not per se prohibited. However, such transfer must follow the principles and requirements as provided by GDPR.

Consequently, the EDPB states in its Guidelines, Art. 48 GDPR does not constitute a transfer mechanism in itself nor a legal basis for processing. It also states that Art. 48 GDPR does not create any privilege regardless whether the requested Controller or Processor may face adverse legal consequences if it refuses to comply with the request. It seems worth highlighting that the EDPB does not distinguish whether such consequences result from European Union or third country law. 

Because the EDPB concludes that Art. 48 GDPR does not provide any privileges in itself, it determines that a two-step test must applied in each case where personal data is being requested by third country courts or authorities. 

• Is there at least one legal basis for the processing of the affected personal data under GDPR, and are all relevant provisions of GDPR complied with?
• Will the specific provisions of Chapter V be complied with in respect of the transfer of personal data to the requesting third country. 

It is worth noting, that the first step - legitimacy of processing - is certainly two-fold in itself. Even though the EDPB does not explicitly refer to this scenario, the legitimacy applies to the processing at the requested party in general, and the processing by means of providing access to the requesting court or authority. it will certainly escalate complexities in cases where the general processing of the requested personal data is already illegitimate, 

The EDPB considers Art. 6.1 lit c) GDPR as legal basis for the processing of personal data by means of providing access to such data to the requesting court or authority, where the request from a third country authority "is based on an international agreement, which may give such request the effect of a legal obligation to which the controller is subject and non-compliance would have legal consequences.”

The EPDB notes that only international agreements which meet the requirements as of Art. 46.2 lit a) GDPR may act as a transfer mechanism. The EDPB has provided a set of minimal elements and requirements for such international agreements in order to qualify as international agreement under Art. 46.2 lit a) GDPR.

If no suitable international agreement exists, the EDPB clarifies that the request may still be followed. However, this will require a thorough individual legal analysis. If such analysis concludes that an alternative transfer mechanism exists under Chapter V GDPR and that there will be sufficient safeguards and supplementary measures in place to enshrine the data protection level of data subjects as enshrined within the European Union, the EDPB considers that Art. 48 GDPR does not prevent from such transfers. 

The EDPB acknowledges that additional legal requirements may apply when a third country court or authority requests access. Such legal requirements may result from procedural or international agreements. The EDPB has not assessed each of such requirements individually, nor does it claim that the Guidelines provide an exhaustive legal perspective. The Guidelines only reflect the requirements under GDPR. 

Responsible for the processing of personal data remains the Controller. Consequently, the assessment of whether a request shall be followed or must be refused is an obligation of the Controller. 

However, requests may be directly addressed towards processors. In this scenario, Processors are prohibited to take any actions other than notifying the Controller about such request and wait for any related instructions. The EDPB notes that Processors may act differently, where Union law or Member State law to which the processor is subject prohibits them to inform the controller on “important grounds of public interest. See also EDPB Guidelines 07/2020.