1. In the absence of a decision pursuant to Article 45(3) of Regulation (EU) 2016/679 or to Article 36(3) of Directive (EU) 2016/680, a controller or processor may transfer personal data to a third country or to an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
2. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from the European Data Protection Supervisor, by:
(a)
a legally binding and enforceable instrument between public authorities or bodies;
(b)
standard data protection clauses adopted by the Commission in accordance with the examination procedure referred to in Article 96(2);
(c)
standard data protection clauses adopted by the European Data Protection Supervisor and approved by the Commission pursuant to the examination procedure referred to in Article 96(2);
(d)
where the processor is not a Union institution or body, binding corporate rules, codes of conduct or certification mechanisms pursuant to points (b), (e) and (f) of Article 46(2) of Regulation (EU) 2016/679.
3. Subject to the authorisation from the European Data Protection Supervisor, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:
(a)
contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or
(b)
provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.
4. Authorisations by the European Data Protection Supervisor on the basis of Article 9(7) of Regulation (EC) No 45/2001 shall remain valid until amended, replaced or repealed, if necessary, by the European Data Protection Supervisor.
5. The Union institutions and bodies shall inform the European Data Protection Supervisor of the categories of cases in which this Article has been applied.