gdpr
GDPR: Transfer (chapter V)
<p>I am challenged to apply article 49 (derogations) for an international organisation, according to art.4 (26). Basically the attempt is to claim that when a user is entering data on some web application of the international organisation, it is a "transfer", so chapter V would apply.</p>

<p>My understanding is:</p>

<ol>
<li>art.44 general principle reads ""Any transfer.... shall take place only if ... the conditions laid down in this Chapter are complied with by the controller and processor...", which already implies the involvement of a controller and processor. In the interpretation of the "transfer" as data entering, the controller/processor does not exist or should coincide either with the Data Subject or with the international organisation, which sounds weird to me.</li>
</ol>

<p>Is it stated clearly somewhere that the international organisation cannot be also the controller in the framework of the Chapter V articles?
Is it stated clearly or deducted in some ways (from law) that the Data Subject cannot be him/herself the Controller of his own information that he/she... transfers(when entering data) into the international organisation web application?</p>

<ol start="2">
<li>Art. 13 (1)(f) clearly references Chapter V articles (46, 47, 49) in a context where it is the controller which transfers the data to the international organisation.</li>
</ol>

<p>Does it help (and on which legal grounds?) to exclude that chapter V articles apply in the case of a Data subject transferring(entering) data into an international organisation web application?
Again, which legal grounds exclude the Controller in the Art. 13 to coincide with the Data Subject?</p>

<p>The concept of an international transfer is orthogonal to other processing. The GDPR does not restrict the concept of transfers to those where the source is a controller. Instead:</p>

<ul>
<li>the source of an international transfer can be a data subject, controller, or processor (GDPR does not mention or restrict the source)</li>
<li>the target of an international transfer can be (per Recital 101)

<ul>
<li>a controller or processor in a third country</li>
<li>an international organization in the sense of Art 4(26)</li>
</ul></li>
</ul>

<p>So yes, if someone (controller, processor, data subject) enters information in the website of an international organization that is an international transfer of this data. That international organization acts as the data controller here. Nothing in the GDPR provides a blanket exception from data controller responsibilities for international organizations.</p>

<p>It is not impossible that a data subject of some processing is simultaneously the controller responsible for that data processing. For example, a sole trader offers some service that involves personal data, and is themselves a user of this service. However, in such a scenario the data subject rights become meaningless because the subject/controller can satisfy these rights directly (you cannot violate your own rights). In practice, it is more useful to assume that the data subject and the data controller are distinct entities.</p>

<p>Who the controller is in your scenario depends solely on who meets the Art 4(7) definition: who determines the purposes of processing? And what are these purposes?</p>

<ul>
<li>The international organization determines the purposes for how this data is processed, it is therefore potentially a controller.</li>
<li>But the processing purposes must fall under Union or Member state law (compare Art 2(2), Art 4(7)).</li>
<li>If the processing purposes fall outside of Union or Member State law, then the GDPR does not apply and the international organization cannot be treated as the controller for that processing.</li>
<li>Such processing would then have no controller in the sense of the GDPR.</li>
</ul>

<p>So assuming that some specific processing activity by an international organization is not subject to the GDPR, would sending personal data to this organization still be a transfer?</p>

<p>Generally yes, but it is the controller's job to ensure the safety of this transfer (Art 44). So we have to distinguish two cases:</p>

<ul>
<li>personal data is transferred from a controller to the international organization that is not a controller for this processing. Here, the controller is responsible for compliance and must protect the transfer pursuant to chapter 5.</li>
<li>personal data is transferred directly from a data subject to the international organization that is not a controller for this processing. <strong>Here, no controller exists, and the entire transfer falls out of scope of the GDPR.</strong></li>
</ul>

<p>For you, this means that you should check whether the processing really falls outside the scope of Union or Member State law.</p>

<ul>
<li>If the processing is within scope of the GDPR, then the international organization is a controller, and it must comply with the requirements for international transfers as per chapter 5.</li>
<li>If the processing falls out of scope of the GDPR, no compliance requirements exist, also not any requirements about international transfers.</li>
</ul>
