Assesses GDPR Article 49 derogation conditions for international data transfers without adequacy decisions or safeguards, covering explicit consent, contract necessity, public interest, vital interests, public registers, and compelling legitimate interests.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
Article 49 GDPR provides a limited set of derogations permitting international data transfers in the absence of an adequacy decision (Art. 45) or appropriate safeguards (Art. 46). The EDPB has consistently emphasised in Guidelines 2/2018 on derogations under Article 49 (adopted 25 May 2018, last updated 6 February 2018) that these derogations must be interpreted restrictively and are intended a...
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
Article 49 GDPR provides a limited set of derogations permitting international data transfers in the absence of an adequacy decision (Art. 45) or appropriate safeguards (Art. 46). The EDPB has consistently emphasised in Guidelines 2/2018 on derogations under Article 49 (adopted 25 May 2018, last updated 6 February 2018) that these derogations must be interpreted restrictively and are intended as exceptions rather than the rule. They cannot serve as a basis for systematic, large-scale, or regular transfers.
Condition: The data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards.
Requirements:
Athena Global Logistics example use case: A European customer requests that their consignment tracking data be shared with their own broker in a non-adequate country. The customer is informed of the risks and explicitly consents via a signed transfer consent form.
Limitations (EDPB Guidelines 2/2018):
Condition: The transfer is necessary for the performance of a contract between the data subject and the controller, or the implementation of pre-contractual measures taken at the data subject's request.
Requirements:
Athena Global Logistics example use case: A European individual customer contracts Athena to ship personal effects to a non-adequate country. Transfer of the customer's address and contact details to the destination country delivery partner is necessary to perform the shipping contract.
EDPB restrictive interpretation:
Condition: The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person.
Requirements:
Athena Global Logistics example use case: Athena arranges cargo insurance with a non-EU insurer on behalf of a customer. The transfer of the customer's details to the insurer is in the customer's interest to ensure coverage.
Condition: The transfer is necessary for important reasons of public interest.
Requirements:
Athena Global Logistics example use case: Transfer of customer identity and shipment data to a third-country customs authority pursuant to a bilateral customs cooperation agreement between Germany and the third country, as required by EU Regulation 952/2013 (Union Customs Code).
Condition: The transfer is necessary for the establishment, exercise, or defence of legal claims.
Requirements:
Athena Global Logistics example use case: Transfer of employment records to a non-EU jurisdiction where a former employee has filed a labour dispute claim, and the records are necessary for the company's defence.
Condition: The transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent.
Requirements:
Athena Global Logistics example use case: Transfer of a crew member's medical records to a third-country hospital following a medical emergency during international transport operations.
Condition: The transfer is made from a register which according to Union or Member State law is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest.
Requirements:
Athena Global Logistics example use case: Transfer of company registration data from the German Handelsregister to a non-EU business partner for due diligence purposes, where the Handelsregister is a public register under German law.
Condition: Where none of the other derogations applies, a transfer may take place if: (a) the transfer is not repetitive; (b) concerns only a limited number of data subjects; (c) is necessary for the purposes of compelling legitimate interests pursued by the controller; (d) these interests are not overridden by the interests or rights and freedoms of the data subject; and (e) the controller has assessed all the circumstances surrounding the transfer and has provided suitable safeguards.
Requirements:
Athena Global Logistics example use case: A one-time transfer of a former employee's contact details to a non-EU regulatory authority investigating a historical compliance matter, where no other derogation applies and the transfer concerns a single individual.
Is there an adequacy decision for the destination country? (Art. 45)
├── YES → Transfer under adequacy; Art. 49 not needed
└── NO → Can appropriate safeguards be established? (Art. 46)
├── YES → Use SCCs/BCRs/etc.; Art. 49 not needed
└── NO → Is the transfer systematic, repetitive, or large-scale?
├── YES → Art. 49 derogations generally NOT available
│ (establish Art. 46 safeguards instead)
└── NO → Apply Art. 49 derogation assessment:
├── Has the data subject explicitly consented? → Art. 49(1)(a)
├── Is transfer necessary for DS contract? → Art. 49(1)(b)
├── Is transfer for a contract in DS interest? → Art. 49(1)(c)
├── Is transfer for important public interest? → Art. 49(1)(d)
├── Is transfer for legal claims? → Art. 49(1)(e)
├── Is transfer for vital interests? → Art. 49(1)(f)
├── Is transfer from a public register? → Art. 49(1)(g)
└── None of the above? → Art. 49(1) compelling legitimate interests
(last resort, with SA notification)
For every transfer relying on an Art. 49 derogation, the following must be documented: