Author: Stephanie Schiedermair
International agreements involving the transfer of personal data to third countries or international organisations which were concluded by Member States prior to 24 May 2016, and which comply with Union law as applicable prior to that date, shall remain in force until amended, replaced or revoked.
I. Introduction
Art. 96 GDPR addresses international agreements concluded by Member States before 24 May 2016 and involving the transfer of personal data to third countries or international organisations.
Neither the Comm nor the EP had included a relevant provision in the course of the trialogue; the Council had introduced a new provision (Art. 89a of Council-R), reading: ‘(…) International agreements involving the transfer of personal data to third countries or international organisations which were concluded by Member States prior to the entry into force of this Regulation, and which are in compliance with Directive 95/46/EC, shall remain in force until amended, replaced or revoked (…)’.
II. Legal background
Art. 96 GDPR is a relatively new provision and seems to miss a concrete legal background. Its introduction appears to stem from Art. 61 LED, addressing the EU competences in the field of police and judicial cooperation that had been limited before the entry into force of the Lisbon Treaty. Art. 61 LED uses the same phrasing, except for some differences on title and dates. Although no specific recital was included in the GDPR, one may refer to the relevant recital 95 of the LED, which, in the law enforcement and criminal justice context, aims to guarantee ‘a comprehensive and consistent protection of personal data in the Union’ by requiring that ‘international agreements which were concluded by Member States prior to the date of entry into force of this Directive and which comply with the relevant Union law applicable prior to that date (…) remain in force until amended, replaced or revoked’.
III. Analysis
Art. 96 GDPR applies to a limited number of agreements, namely: a) international agreements; b) concluded by Member States before 24 May 2016; c) involving transfer of personal data to third countries or international organisations; and d) complying with EU law (applicable before 24 May 2016).
This is an exhaustive, rather than open, list of agreements, leaving out of its scope: any agreement concluded by Member States after the adoption of the GDPR; any agreement concluded by the EU under EU law; and any agreement incompatible with (primary or secondary) EU law up to 24 May 2016 (including, among others, the DPD, the Treaties or the CFR).
Provided the above (from a) to d)) requirements are cumulatively satisfied, relevant international agreements are preserved and remain unaffected, regardless of any question of compatibility with the GDPR.
[…]