The amendment to the Personal Data Protection Act from January of this year allows data controllers to transfer data to third countries that do not provide an adequate level of protection without obtaining the consent of the Polish DPA. According to Article 48 of the aforementioned Act, this applies to two situations:
Receive a package of free GDPR guides and micro-trainings
- when standard contractual clauses approved by the European Commission have been applied in contracts with data processors from third countries, in accordance with Article 26(4) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,
- when legally binding corporate rules approved by the Polish DPA have been applied, in accordance with Article 8(8) of the draft Act on the Facilitation of Business Activity and Article 48(3) of the Personal Data Protection Act.
Legally binding corporate rules pertain to entities belonging to the same group of entrepreneurs (the same capital group). Legally binding corporate rules may be applied after their approval by the Polish DPA (by way of an administrative decision), following optional consultations with the data protection authorities of the countries in the European Economic Area where the entrepreneurs belonging to the aforementioned group are established. If the legally binding corporate rules have been subject to a decision by the aforementioned data protection authority, the Polish DPA may take them into account.
