Feedback for the European Data Protection Board (EDPB) in response to the public consultation on ‘Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data’

The Court of Justice of the European Union (CJEU) emphasised in the ‘Schrems II’ judgment the importance of ensuring ‘effective and enforceable rights and effective administrative and judicial redress’ for data subjects whenever personal data about them are transferred to third countries. The availability of ‘(e)nforceable data subject rights and effective legal remedies for data subjects’ is actually a necessary condition for data exporters to rely on any transfer mechanisms under Article 46 of the General Data Protection Regulation (GDPR). Data subject rights and remedies, however, can only be effectively available to individuals if the data subjects are aware of the existence of such rights and remedies, and if they know how to exercise them. The CJEU has previously stressed that information about data processing directly affects the exercise of data subject rights, and that information obligations imposed on data controllers – beyond being directly connected to the principle of transparency – are also necessary to comply with the principle of fairness