Portugal: Portuguese DPA’s new rules on intragroup transfer agreements
Published 1 January 2016
What does this cover?
The Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados (the CNPD), has issued a deliberation establishing new rules on intragroup transfer agreements (the Deliberation). The Deliberation follows the CJEU’s recent decision leading to the invalidity of European Commission Decision on Safe Harbor.
The CNPD considers intragroup agreements to be, in certain circumstances, a valid mechanism for legitimising international data transfers to third countries that do not provide for an adequate level of protection of the personal data, provided they comply with the European Commission Standard Contractual Clauses. Although authorisation from the CNPD will still be required, with this Deliberation the CNPD seeks to expedite the process of obtaining authorisations for personal data transfers to countries located outside the European Union.
To access the CNPD’s Deliberation, please click here (Portuguese).
What action could be taken to manage risks that may arise from this development?
New approvals can be submitted under the expedited procedure. Organisations may wish to engage with Portuguese counsel to see if they can liaise with the CNPD to get previous approvals submitted to the CNPD (and to date not approved) approved through this new expedited procedure.