conditions of the execution of the criminal penalty, and the level of personal data protection in the third country or an international organisation to which personal data are onward transferred. The competent authority that carried out the original transfer may also subject the onward transfer to specific conditions. Such specific conditions can be described, for example, in handling codes. (46) The Commission may decide with effect for the entire Union that certain third countries, or a territory or one or more specified sectors within a third country, or an international organisation, offer an adequate level of data protection, thus providing legal certainty and uniformity throughout the Union as regards the third countries or international organisations which are considered to provide such a level of protection. In these cases, transfers of personal data to these countries may take place without needing to obtain any specific authorisation, except when another Member State from which the data were obtained has to give its authorisation to the transfer. (47) In line with the fundamental values on which the Union is founded, in particular the protection of human rights, the Commission should, in its assessment of the third country, or of a territory or of a specified sector within a third country, take into account how a given third country respects the rule of law, access to justice as well as international human rights norms and standards and its general and sectoral law, including legislation concerning public security, defence and national security as well as public order and criminal law. The adoption of an adequacy decision relating to a territory or a specified sector in a third country should take into account clear and objective criteria, such as specific processing activities and the scope of applicable legal standards and legislation in force in the third country. The third country should offer guarantees that ensure an adequate level of protection essentially equivalent to that guaranteed within the Union, in particular when data are processed in one or several specific sectors. In particular, the third country should ensure effective independent data protection supervision, provide for cooperation mechanisms with the European data protection authorities, and the data subjects should be provided with effective and enforceable rights and effective administrative and judicial redress. (47a) Apart from the international commitments the third country or international organisation has entered into, the Commission should also take account of obligations arising from the third or international in multilateral or regional systems in country’s organisation’s participation
conditions of the execution of the criminal penalty, and the level of personal data protection in the third country or an international organisation to which personal data are onward transferred. The competent authority that carried out the original transfer may also subject the onward transfer to specific conditions. Such specific conditions can be described, for example, in handling codes. (46) The Commission may decide with effect for the entire Union that certain third countries, or a territory or one or more specified sectors within a third country, or an international organisation, offer an adequate level of data protection, thus providing legal certainty and uniformity throughout the Union as regards the third countries or international organisations which are considered to provide such a level of protection. In these cases, transfers of personal data to these countries may take place without needing to obtain any specific authorisation, except when another Member State from which the data were obtained has to give its authorisation to the transfer. (47) In line with the fundamental values on which the Union is founded, in particular the protection of human rights, the Commission should, in its assessment of the third country, or of a territory or of a specified sector within a third country, take into account how a given third country respects the rule of law, access to justice as well as international human rights norms and standards and its general and sectoral law, including legislation concerning public security, defence and national security as well as public order and criminal law. The adoption of an adequacy decision relating to a territory or a specified sector in a third country should take into account clear and objective criteria, such as specific processing activities and the scope of applicable legal standards and legislation in force in the third country. The third country should offer guarantees that ensure an adequate level of protection essentially equivalent to that guaranteed within the Union, in particular when data are processed in one or several specific sectors. In particular, the third country should ensure effective independent data protection supervision, provide for cooperation mechanisms with the European data protection authorities, and the data subjects should be provided with effective and enforceable rights and effective administrative and judicial redress. (47a) Apart from the international commitments the third country or international organisation has entered into, the Commission should also take account of obligations arising from the third country’s or international organisation’s participation in multilateral or regional systems in
4_consolidated_text_EN.docx