Guidelines 01/2023 on Article 37 Law Enforcement Directive

• Jurisdiction: European Union
• Date: 19 June 2024
• Year: 2024
• Type of Document: Guidance

Adopted 1

Guidelines 01/2023 on Article 37 Law Enforcement Directive

Version 2.1

Adopted on 19 June 2024

Adopted 2

Version history

Version 1.0

27 September 2023

Adoption of the Guidelines for public consultation

Version 2.0

19 June 2024

Adoption of the Guidelines after public consultation

Version 2.1

30 September 2024

Minor corrections in footnotes 10 and 57

Adopted 3

Executive summary

These guidelines provide guidance on the application of Article 37 LED, in particular on the legal

standard for appropriate safeguards to be applied by c ompetent authorities pursuant to Article

37(1)(a) and (b) L ED and, accordingly, on the relevant factors for the assessment of whether such

safeguards exist. These guidelines therefore include an indication as to the EDPB’s expectations of

Member States, as negotiating parties, when envisaging concluding or amending a legally binding

instrument between the concerned Member State(s) and a third country or international organisation

pursuant to Article 37(1)(a) LED.

The EDPB notes that Article 35(3) LE D applies to transfers carried out under Article 37 LED. Article 37

LED should therefore be applied in light of the principle that the level of data protection applicable in

the European Union must not be undermined by the transfer of personal data to another jurisdiction.

The EDPB concludes that Article 37 LED requires an essentially equivalent level of data protec tion in

the recipient third country or international organisation. However, this requirement relates to the

specific data transfer or category of transfers at hand. Pursuant to Article 37 LED, essential equivalence

to the protection guaranteed under the LED should be ensured for that particular case and not

necessarily with regard to the entire existing legislation in the third country or international

organisation.

The EDPB has already adopted Recommendations on the adequacy referential under the LED,

addressing which data protection principles have to be present to ensure essential equivalence with

the EU framework within the scope of the LED. The EDPB considers that the principles and safeguards

outlined in these Recommendations apply in substance in the context of Article 37 LED, i.e. with regard

to the specific transfer or category of transfers.

A legally binding instrument in the meaning of Article 37(1)(a) LED has to be concluded by the entity

empowered to enter int o obligations with respect to the safeguards provided in the instrument. The

international agreement should thus have the force of l aw. Such legally binding instrument can be

enforced by the Parties and by data subjects whose personal data processing is governed by the

agreement. The legally binding instrument should contain all relevant rules to allow overcoming any

shortcomings or limitations of the legislation of the third country or international organisation in terms

of data protection by setting a framework of appropriate safeguards that afford an essentially

equivalent level of data protection.

The E DPB considers that the use of a legally binding instrument regulating personal data transfers

between the Parties should, in the absence of an adequacy decision, in principle, take precedence,

over an assessment by the controlle r according to Artic le 37(1)(b) LED as it provides more legal

certainty, transparency, foreseeability, stability, consistency and guarantees on the effective

application of data protection safeguards.

In this context, the EDPB recalls its Statement on international agreements including transfers,

adopted on 13 April 2021, inviting Member States to assess and, where nec essary, review their

international agreements that involve international transfers of personal data. The EDPB emphasizes

that consideration should be given to the aim of bringing those agreements in line with the LED

requirements for data transfers, where this is not yet the case, to ensure that the level of protection

of natural persons guaranteed by the LED is not undermined when personal data is transferred outside

the Union.

With respect to Article 37(1)(b) LED and in light of the above -mentioned greater guarantees offered

by legally binding instruments, competent authorities may rely on such an assessment only when this