Art49 Derogations

Assessing Article 49 Derogations

Overview

Article 49 GDPR provides a limited set of derogations permitting international data transfers in the absence of an adequacy decision (Art. 45) or appropriate safeguards (Art. 46). The EDPB has consistently emphasised in Guidelines 2/2018 on derogations under Article 49 (adopted 25 May 2018, last updated 6 February 2018) that these derogations must be interpreted restrictively and are intended as exceptions rather than the rule. They cannot serve as a basis for systematic, large-scale, or regular transfers.

Derogation Conditions

Art. 49(1)(a) — Explicit Consent

Condition: The data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards.

Requirements:

1. Specific: Consent must specifically cover the transfer to the identified third country, not merely the processing activity itself.
2. Informed: The data subject must be told:
   • The specific third country or countries to which data will be transferred
   • The absence of an adequacy decision for that country
   • The absence of appropriate safeguards (SCCs, BCRs)
   • The specific risks arising from this (e.g., government access without EU-equivalent protections)
3. Explicit: Must be an unambiguous affirmative statement; implied consent or pre-ticked boxes are insufficient.
4. Freely given: No detriment to the data subject for withholding consent; must be a genuine choice.
5. Withdrawable: Data subject can withdraw consent at any time; withdrawal does not affect lawfulness of prior transfers.

Athena Global Logistics example use case: A European customer requests that their consignment tracking data be shared with their own broker in a non-adequate country. The customer is informed of the risks and explicitly consents via a signed transfer consent form.

Limitations (EDPB Guidelines 2/2018):

• Cannot be used for systematic, repetitive, or large-scale transfers
• Not appropriate in employer-employee relationships due to the power imbalance (consent is unlikely to be freely given)
• Not a substitute for establishing systematic transfer mechanisms

Art. 49(1)(b) — Necessary for Contract Performance

Condition: The transfer is necessary for the performance of a contract between the data subject and the controller, or the implementation of pre-contractual measures taken at the data subject's request.

Requirements:

1. Direct contractual relationship: A contract exists between the data subject and the controller (not between two controllers or a controller and a third party).
2. Necessity: The transfer must be objectively necessary for performing the contract — not merely useful or commercially convenient.
3. Close and substantial connection: There must be a close link between the transfer and the performance of the specific contractual obligation.
4. Occasional: This derogation is appropriate for occasional transfers; systematic reliance is not permitted.

Athena Global Logistics example use case: A European individual customer contracts Athena to ship personal effects to a non-adequate country. Transfer of the customer's address and contact details to the destination country delivery partner is necessary to perform the shipping contract.

EDPB restrictive interpretation:

• The contract must be with the data subject themselves, not with a corporate customer transferring employee data
• The fact that a transfer is commercially necessary is not sufficient; it must be contractually necessary
• If alternative means of contract performance exist that do not require the transfer, this derogation may not apply

Art. 49(1)(c) — Necessary for Contract in the Interest of the Data Subject

Condition: The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person.

Requirements:

1. Contract between controller and a third party: Unlike Art. 49(1)(b), this covers contracts where the data subject is not a party.
2. In the interest of the data subject: The contract must serve the data subject's interests (e.g., insurance taken out on their behalf, travel arrangements made for them).
3. Necessity: The transfer must be objectively necessary for the contract, not merely convenient.
4. Occasional: Not a basis for systematic transfers.

Athena Global Logistics example use case: Athena arranges cargo insurance with a non-EU insurer on behalf of a customer. The transfer of the customer's details to the insurer is in the customer's interest to ensure coverage.

Art. 49(1)(d) — Important Reasons of Public Interest

Condition: The transfer is necessary for important reasons of public interest.

Requirements:

1. Recognised in EU or Member State law: The public interest must be recognised in Union law or in the law of the Member State to which the controller is subject.
2. Important: Not any public interest qualifies; it must be of significant importance (e.g., international cooperation for tax enforcement, anti-money laundering, cross-border criminal investigations).
3. Necessary: The transfer must be necessary to serve that public interest.
4. Cannot be used by private entities for commercial purposes: Private companies cannot invoke public interest to justify commercial data transfers.

Athena Global Logistics example use case: Transfer of customer identity and shipment data to a third-country customs authority pursuant to a bilateral customs cooperation agreement between Germany and the third country, as required by EU Regulation 952/2013 (Union Customs Code).

Art. 49(1)(e) — Legal Claims

Condition: The transfer is necessary for the establishment, exercise, or defence of legal claims.

Requirements:

1. Actual or contemplated proceedings: There must be actual legal proceedings or a concrete and identifiable prospect of proceedings (not merely a theoretical possibility).
2. Necessity: Only the data necessary for the legal claim may be transferred.
3. Broad scope: Covers judicial proceedings, administrative proceedings, and out-of-court procedures including regulatory investigations.
4. Occasional: Transfers must be linked to specific proceedings, not used as a routine transfer basis.

Athena Global Logistics example use case: Transfer of employment records to a non-EU jurisdiction where a former employee has filed a labour dispute claim, and the records are necessary for the company's defence.