Guidelines 01/2023 on Article 37 Law Enforcement Directive

What it covers

This document provides guidance on the application of Article 37 of the Law Enforcement Directive, covering the legal standard for appropriate safeguards under Article 37(1)(a) and (b) and the factors competent authorities must assess when transferring personal data to third countries or international organisations for law enforcement purposes.

Why it matters

It guides Member States and law enforcement authorities on how to lawfully structure international data-sharing arrangements outside the framework of adequacy decisions.

Refer to it when

• negotiating a police cooperation agreement with a non-EU country
• assessing appropriate safeguards for an ad hoc law enforcement data transfer
• determining accountability obligations after relying on Article 37(1)(b)
• distinguishing LED transfer requirements from GDPR Chapter V

Questions this document addresses

• What constitutes a legally binding instrument under Article 37(1)(a) LED?
• When may a competent authority rely on its own assessment under Article 37(1)(b) LED?
• How should the risk to data subjects be factored into a transfer assessment?
• What accountability obligations follow from using Article 37(1)(b) LED?

Topics

• International transfers
• Law enforcement
• Supervisory authorities