Transferring personal data outside the EU or EEA
Within the EU and EEA, personal data are processed under the same principles as in Finland. The EEA includes EU Member States as well as Norway, Liechtenstein and Iceland.
If data are transferred or processed outside the EU/EEA, this constitutes a transfer to a so-called third country. Such transfers must have a lawful transfer mechanism under the GDPR.
Remote access from outside the EU/EEA may constitute a personal data transfer
Accessing data remotely from outside the EU or EEA may be considered a transfer of personal data to a third country, even when the data itself is held within a remote processing environment.
However, if a person processing personal data acts on behalf of a controller established in the EU/EEA (for example as an employee), processing in third countries is not usually considered a transfer of personal data.
Transfer mechanisms
Transfers to countries outside the EU or EEA are permitted where at least one of the following transfer mechanisms applies. The primary mechanism is an adequacy decision.
▸ Article 45 – Adequacy decision (safe country)
The European Commission has determined that the level of data protection in the destination country is adequate. Where this mechanism applies, no additional measures are required. Findata takes this into account in the data permit decision.
▸ Article 46 – Standard Contractual Clauses (SCCs)
Model contractual clauses approved by the European Commission between the controller and processor. The applicant must provide signed SCCs to Findata before data can be processed outside the EU/EEA. The clauses may not be modified.
▸ Article 47 – Binding Corporate Rules (BCRs)
Common binding rules on personal data transfers within a corporate group. The applicant must submit the rules to Findata for information.
▸ Article 49 – Derogations
For example, the explicit consent of the data subject to the transfer. These may only be used in exceptional cases.
Data may only be transferred outside the EU or EEA if Findata’s data permit decision expressly authorises such a transfer.