Robert Bond (robert.bond@bristows.com) is Partner & Notary Public at Bristows LLP in London, United Kingdom.
In relation to personal data, there are a number of mechanisms available to allow the transfer of such data from the European Union (EU) to countries outside the EU (Third Countries) under the European Data Protection Directive (95/46 EC) and member state laws.
The EU General Data Protection Regulation (2016/679) (GDPR), which goes into effect 25 May 2018, simplifies the mechanisms available to protect the rights of individuals in relation to international data transfers.
Although express consent is one mechanism that enables the transfer of data from the EU to Third Countries, there are other mechanisms that adduce the protection of the rights of individuals in relation to their personal data, including that the Third Country is “approved” by the European Commission, the parties have entered into EU-approved standard contractual clauses, and there are approved Binding Corporate Rules (BCR) in place. In addition, for transfers from the EU to the USA, as well as from Switzerland to the USA, there is the Privacy Shield framework.