FantasticSearch

General principles for transfers of operational personal data

1. The EPPO may transfer operational personal data to a third country or international organisation, subject to compliance with the other provisions of this Regulation, in particular Article 53, only where the conditions laid down in the Articles 80 to 83 are met, namely:

(a) the transfer is necessary for the performance of the tasks of the EPPO;

(b) the operational personal data are transferred to a controller in a third country or international organisation that is an authority competent for the purpose of Article 104;

(c) where the operational personal data to be transferred in accordance with this Article have been transmitted or made available by a Member State of the European Union to the EPPO, the latter shall obtain prior authorisation for the transfer by the relevant competent authority of that Member State of the European Union in compliance with its national law, unless that Member State of the European Union has granted this authorisation to such transfer in general terms or subject to specific conditions;

(d) the Commission has decided pursuant to Article 81 that the third country or international organisation in question ensures an adequate level of protection, or in the absence of such an adequacy decision, where appropriate safeguards are adduced or exist pursuant to Article 82, or both in absence of an adequacy decision and of such appropriate safeguards, derogation for specific situations apply pursuant to Article 83; and (e) in the case of an onward transfer to another third country or international organisation by a third country or international organisation, the EPPO shall require the third country or international organisation to seek its prior authorisation for that onward transfer, which the EPPO may provide only after taking into due account all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data was originally transferred and the level of personal data protection in the third country or an international organisation to which operational personal data are onward transferred.

2. The EPPO may transfer operational personal data without prior authorisation by a Member State of the European Union in accordance with point (c) of paragraph 1 only if the transfer of the operational personal data is necessary for the prevention of an immediate and serious threat to public security of a Member State of the European Union or a third country or to essential interests of a Member State of the European Union and the prior authorisation cannot be obtained in good time. The authority responsible for giving prior authorisation shall be informed without delay.

3. The transfer of operational personal data received from the EPPO to a third country or an international organisation by a Member State of the European Union, or institution, body, office or agency of the Union shall be prohibited. This shall not apply in cases where the EPPO has authorised such transfer, after taking into due account all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data was originally transmitted and the level of personal data protection in the third country or an international organisation to which operational personal data are transferred. That obligation to obtain prior authorisation from the EPPO shall not apply to cases that have been referred to competent national authorities in accordance with Article 34.

4. Articles 80 to 83 shall be applied in order to ensure that the level of protection of natural persons ensured by this Regulation and by Union law is not undermined.