# Standards and Regulatory References

## Primary Legislation

### GDPR Article 49 — Derogations for Specific Situations
- **Art. 49(1)(a)**: Explicit consent after being informed of risks
- **Art. 49(1)(b)**: Necessary for performance of contract between data subject and controller
- **Art. 49(1)(c)**: Necessary for contract concluded in interest of data subject between controller and another person
- **Art. 49(1)(d)**: Necessary for important reasons of public interest recognised in EU or Member State law
- **Art. 49(1)(e)**: Necessary for establishment, exercise, or defence of legal claims
- **Art. 49(1)(f)**: Necessary to protect vital interests where data subject is incapable of giving consent
- **Art. 49(1)(g)**: Transfer from a public register
- **Art. 49(1) second subparagraph**: Compelling legitimate interests (last resort, not repetitive, limited data subjects, SA notification required)
- **Art. 49(2)**: Where transfer cannot be based on adequacy or safeguards, and no derogation applies, transfer may take place only if not repetitive, limited data subjects, compelling legitimate interests, suitable safeguards, SA informed
- **Art. 49(3)**: Art. 49(1)(g) transfers must not involve the entirety of the register; conditions for consultation must be met
- **Art. 49(4)**: Transfers under Art. 49(1)(d) may also be laid down in EU or Member State law
- **Art. 49(5)**: In the absence of an adequacy decision, EU or Member State law may limit transfers for important public interest reasons
- **Art. 49(6)**: Controller must document the assessment under Art. 49(1) second subparagraph in the records of processing under Art. 30

## EDPB Guidelines

### EDPB Guidelines 2/2018 on Derogations of Article 49 (Adopted 25 May 2018)
- **Key principle**: Art. 49 derogations must be interpreted restrictively so that the exception does not become the rule.
- **Occasional nature**: Derogations are designed for occasional transfers; they cannot substitute for systematic transfer mechanisms under Art. 45/46.
- **Explicit consent (Art. 49(1)(a))**:
  - Must be specific to the transfer (not just to the processing)
  - Must include information about risks of transfer to a country without adequate protection
  - Cannot be used in employment context due to power imbalance
  - Cannot serve as basis for systematic, mass transfers
- **Contract necessity (Art. 49(1)(b))**:
  - Contract must be directly between the data subject and the controller
  - Transfer must be objectively necessary, not merely useful
  - Close and substantial connection between transfer and contract performance required
- **Public interest (Art. 49(1)(d))**:
  - Must be recognised in EU or Member State law
  - Important rather than trivial public interest required
  - Cannot be invoked by private companies for commercial purposes
- **Compelling legitimate interests (Art. 49(1) second subparagraph)**:
  - Absolute last resort
  - Not repetitive: single or few-time transfers
  - Limited number of data subjects
  - Higher threshold than Art. 6(1)(f) balancing test
  - SA notification is mandatory

### EDPB Guidelines 05/2020 on Consent under Regulation 2016/679 (Version 1.1, 4 May 2020)
- Provides general consent requirements applicable to Art. 49(1)(a) explicit consent
- Explicit consent requires a clear affirmative statement specifically referring to the transfer and its risks
- Pre-formulated consent forms must be distinguishable from other matters

## Enforcement Precedents

### EDPS Guidance on Schrems II and Art. 49 (October 2020)
- Confirmed that Art. 49 derogations cannot be used as a systematic alternative to invalidated Privacy Shield
- Organisations must prioritise establishing Art. 46 safeguards
- Art. 49(1)(b) contract necessity cannot justify transfers that are merely commercially convenient

### Danish Datatilsynet — Chromebook Decision (2022)
- Held that a municipality's transfer of student data to Google in the US could not rely on Art. 49 derogations because the transfers were systematic and large-scale
- Required the municipality to establish Art. 46 safeguards or cease the transfers

### Austrian DSB — Guidance on Art. 49 Post-Schrems II (2021)
- Warned against using Art. 49(1)(a) consent as a workaround for the loss of Privacy Shield
- Consent-based transfers to the US would need to meet all explicit consent requirements and remain occasional

### French CNIL — FAQ on International Transfers (2022)
- Confirmed that Art. 49 derogations are not a general solution for US transfers post-Schrems II
- Recommended organisations establish SCCs with supplementary measures as the primary mechanism
- Art. 49 reserved for truly exceptional, one-off transfers

## Related GDPR Provisions

### Article 7 — Conditions for Consent
- **Art. 7(1)**: Controller must demonstrate consent was given
- **Art. 7(2)**: Written consent request must be clearly distinguishable, intelligible, easily accessible, clear and plain language
- **Art. 7(3)**: Right to withdraw consent at any time; withdrawal must be as easy as giving consent
- **Art. 7(4)**: Consent must be freely given; cannot be conditional on contract performance where consent is not necessary for the contract

### Article 6(1)(f) — Legitimate Interests
- Relevant to Art. 49(1) second subparagraph as the baseline legitimate interest concept, with Art. 49 requiring a higher threshold of "compelling" legitimate interests

### Article 30 — Records of Processing Activities
- **Art. 30(1)(e)**: Transfers to third countries must be recorded in the RoPA
- Art. 49(6) requires Art. 49(1) second subparagraph assessments to be included in Art. 30 records