254. To reflect this, the government proposes to amend the legislation to be clear that both administrative and judicial redress are acceptable as long as the redress mechanism is effective. The government welcomes views on the following questions: Q3.2.4. To what extent do you agree that redress requirements for international data transfers may be satisfied by either administrative or judicial redress mechanisms, provided such mechanisms are effective? ○ Strongly agree ○ Somewhat agree ○ Neither agree nor disagree ○ Somewhat disagree ○ Strongly disagree Please explain your choice, and provide supporting evidence where possible.
3.3 Alternative Transfer Mechanisms 255. Alternative transfer mechanisms provide a route for cross-border transfers of personal data to countries that are not subject to an adequacy decision. Alternative transfer mechanisms are typically agreements which provide binding and enforceable protections for individuals' personal data when it is transferred internationally. Explanatory box: What are alternative transfer mechanisms? The UK GDPR restricts transfers of personal data to countries outside the UK. If another country has been assessed as adequate (see text box under section 4.2), organisations may send personal data to recipients in that country without the need for additional safeguards. If the recipient is in a country, territory, or sector which has not been assessed as adequate, organisations must put in place ‘appropriate safeguards’ in order to make a transfer of personal data. Article 46 of the UK GDPR provides a range of options for how appropriate safeguards can be provided. These safeguards are commonly known as alternative transfer mechanisms. These transfer mechanisms ensure appropriate protection for individuals’ rights and freedoms in respect of their personal data when it is transferred across borders. Alternative transfer mechanisms typically take the form of a binding and enforceable contract. Article 46 of the UK GDPR provides for the following alternative transfer mechanisms: ● ● ● ●
A legally binding and enforceable instrument between public authorities UK binding corporate rules Standard data protection clauses An approved code of conduct together with binding and enforceable commitments of the controller and processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights 92
