„Our employees do not keep passwords under the keyboard."
Are you sure about that?
Article 45 GDPR
Transfer on the basis of a decision establishing an appropriate level of protection
1. The transfer of personal data to a third country or international organization may take place when the Commission determines that the third country, territory or specific sector(s) within that third country or international organization in question provide an adequate level of protection. Such transfer does not require special authorization.
2. In assessing whether the degree of protection is adequate, the Commission shall consider the following elements in particular:
(a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation - both general and sectoral - including in the areas of public security, defense, national security and criminal law, and access to personal data by public authorities, as well as the implementation of such legislation, rules on the protection of personal data, rules on the exercise of a profession, security measures, including rules on onward transfers of personal data to another third country or other international organization, which are complied with in that country or international organization, case law, as well as the existence of effective and enforceable rights of data subjects and the rights of data subjects whose personal data is transferred to effective administrative and judicial remedies;
(b) the existence and effective functioning of at least one independent supervisory authority in a third country or in relation to an international organisation responsible for ensuring and enforcing compliance with data protection law including having appropriate powers to enforce compliance to assist and advise data subjects in the exercise of their rights and to cooperate with the supervisory authorities of the Member States; and
(c) international obligations undertaken by the third country or international organisation concerned or other obligations arising from legally binding conventions or instruments and from participation in multilateral or regional systems, in particular in the field of personal data protection.
3. After assessing whether the level of protection is adequate, the Commission may, by means of an implementing act, adopt a decision determining that a third country, a territory, or a specific sector or sectors within that third country, or an international organization, ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for periodic review—at least once every four years—during which any relevant changes in the third country or international organization are taken into account. The implementing act shall specify its territorial and sectoral scope of application and, where applicable, shall designate the supervisory authority or authorities referred to in paragraph 2(b) of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).
4. The Commission shall monitor on an ongoing basis developments in third countries and international organizations that may affect the validity of decisions adopted pursuant to paragraph 3 of this Article and decisions adopted pursuant to Article 25(6) of Directive 95/46/EC.
5. If the available information indicates, in particular following the review referred to in paragraph 3 of this Article, that a third country — or a territory or one or more specific sectors within that third country — or an international organization no longer ensures an adequate level of protection within the meaning of paragraph 2 of this Article, and, to the extent necessary, repeals, amends, or suspends the decision referred to in paragraph 3 of this Article by means of implementing acts without retroactive effect. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). In duly justified cases of particular urgency, the Commission shall adopt immediately applicable implementing acts in accordance with the procedure referred to in Article 93(3).
6. The Commission shall enter into consultations with a third country or an international organization to remedy the situation giving rise to the decision adopted under paragraph 5.
8. The Commission publishes in the Official Journal of the European Union and on its website a list of third countries, territories and specific sectors in a third country, as well as international organizations for which it has adopted a decision declaring an adequate degree of protection or lack thereof.
9. Decisions adopted by the Commission pursuant to Article 25(6) of Directive 95/46/EC shall remain in force until they are amended, replaced, or repealed by a Commission decision adopted in accordance with paragraph 3 or 5 of this Article.
