Module 7 · Derogations & restrictions (Article 49)
Derogations under Article 49 are last-resort exemptions, narrowly interpreted, that allow a transfer in specific situations only when neither adequacy nor safeguards apply. They include explicit consent, necessity for a contract, public interest, legal claims, vital interests, transfer from a public register, and compelling legitimate interests (non-repetitive, limited number of people). Two restrictions bite: Article 48 (foreign court/authority orders only recognised via an international agreement or EU/Member State law) and Article 49(5) (Member States may limit transfers of specific data categories for important public-interest reasons).
Derogations are the last resort - used only when neither nor appropriate safeguards are available. Their criteria are strict and must be narrowly interpreted.
- Explicit consent to the proposed transfer (informed of the risks).
- Necessary for the performance of a contract (with the data subject, or in their interest).
- Necessary for important reasons of public interest.
- Establishment, exercise or defence of legal claims.
- Protection of vital interests of the data subject or others.
- Transfer from a public register.
- Compelling legitimate interests that are non-repetitive and for a limited number of data subjects.
Article 48: a foreign court/authority order for data is only recognised via an international agreement (e.g. a mutual legal assistance treaty) or EU/Member State law - you cannot just hand data over. Article 49(5): Member States may, for important public-interest reasons, limit transfers of specific data categories.