Article

Personal data transfer to overseas regulator permitted despite lack of adequacy status

Personal data transfer to overseas regulator permitted despite lack of adequacy status
Published Date
Jul 30 2024
In the context of a fraud investigation being conducted by the Ukrainian Bureau of Economic Security, the UK High Court has permitted a bank to disclose two schedules of data to the overseas regulator in satisfaction of a Ukrainian court order.  

Amongst other issues, the UK court was required to decide if one of the derogations contained in Article 49 UK GDPR applied. In this case, the court permitted the disclosure on the basis that the Article 49(1)(e) derogation applied, with the transfer being “necessary for the establishment, exercise or defence of legal claims”. 

Our cyber team considers the decision in more detail in this post to A&O Shearman on data.

 

Related capabilities