The overall legal and regulatory landscape setting out the framework for Data Protection in the EU is soon to change. At present, the legislative framework for Data Protection in the EU dates back to 1995. The “Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data” along with national laws transposing the Directive are still the law of the land. This will change significantly from May 2018 onwards, when the EU General Data Protection Regulation will enter into force and have direct effect in all EU member states. Increased compliance efforts by all organisations in scope of the GDPR will be required, and the legal significance of national data protection laws be significantly reduced due to the direct applicability of the GDPR.
The GDPR for the first time expressly mentions “International Organisations” as recipients of data transfers. It does so in the same vein as it mentions third countries not offering an adequate level of data protection. In other words, what the GDPR seems to suggest is that data transfers from any of the EU member states to an international organisation are only permitted under certain conditions. These conditions are designed to ensure that the transfer to and subsequent handling of personal data in the receiving country or international organisation occur under conditions acceptable by EU standards. Generally, the European Commission would assess if legal, procedural and constitutional principles in the recipient country (or international organisation) are broadly comparable to those in force in the EU in the area of Data Protection, including legal remedies and oversight available.