EDPS unveils new model for safer transfers of personal data between EU Institutions and International Organisations

The EDPS has published today its Model Administrative Arrangement (Model) for transfers of personal data from EU institutions, bodies, offices and agencies (EUIs) to International Organisations. The Model aims to help EUIs comply with the applicable EU data protection law, Regulation (EU) 2018/1725, when they need to transfer personal data to International Organisations, within the remit of their role.

Wojciech Wiewiórowski, EDPS, said: "Depending on the nature of their work, EUIs may have to transfer personal data to International Organisations to fulfil important objectives, such as providing food assistance or advocating for individuals' rights, for example. In this context, it is one of my institution's priorities to ensure that individuals' personal data is protected according to EU standards both inside and outside the EU/European Economic Area. The new Model Administrative Arrangement allows EUIs to prepare effectively for possible transfers of personal data to International Organisations, in a comprehensive way".

To ensure its practical application by EUIs, the Model places emphasis on data protection's core principles and puts in place the necessary safeguards, as a way to ensure a level of protection essentially equivalent to that guaranteed by EU legislation.

As such, the administrative arrangements concluded by EUIs with International Organisations using the model published today will continue to require the EDPS' approval. However, its use by EUIs will greatly facilitate the approval process, to the benefit of both parties and the individuals concerned.

Background Information

The European Data Protection Supervisor (EDPS) is the independent supervisory authority for the protection of personal data and privacy and promoting good practice in the EU institutions and bodies.

The EDPS' tasks include:

• monitoring the EU administration's processing of personal data;
• monitoring and advising technological developments on policies and legislation that affect privacy and personal data protection;
• carrying out investigations, including in the form of data protection audits/inspections;
• cooperating with other supervisory authorities to ensure consistency in the protection of personal data.

EDPS - The EU's Independent Data Protection Authority