// 4.2. THIRD COUNTRIES AND INTERNATIONAL ORGANISATIONS

When it comes to transfers of personal data to third countries and international organisations, the legislator has introduced very strict safeguards.

Namely, Europol may transfer personal data to an authority of a third country or to an international organisation only, insofar as such transfer is necessary for the performance of Europol's tasks, on the basis of one of the following:

a decision of the Commission adopted in accordance with Article 36 of Directive (EU) 2016/680, finding that the third country or a territory or a processing sector within that third country or the international organisation in question ensures an adequate level of protection (‘adequacy decision’);

an international agreement concluded between the Union and that third country or international organisation pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals;

a cooperation agreement allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and that third country or international organisation in accordance with Article 23 of Decision 2009/371/JHA.

If none of these conditions can be met, the Executive Director may authorise the exceptional transfer of personal data to third countries or international organisations on a case-by-case basis if the transfer is:

(a) necessary in order to protect the vital interests of the data subject or of another person;

(b) necessary to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides;

(c) essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country;

(d) necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions; or

(e) necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence or the execution of a specific criminal sanction.

Personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e).

Derogations may not be applicable to systematic, massive or structural transfers and the Executive Director needs to inform both the Management Board and the EDPS as soon as possible whenever he makes use of this exception clause.

Furthermore, the Management Board may, in agreement with the EDPS, authorise for a period not exceeding one year, which shall be renewable, a set of transfers in accordance with points (a) to (e) above, taking into account the existence of adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Such authorisation shall be duly justified and documented.