Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.
Article 48
Transfers or disclosures not authorised by Union law
Understanding This Article
Article 48 is a critical jurisdictional protection that prevents third country authorities from unilaterally demanding personal data held by EU-established controllers or processors. It recognizes that in an interconnected world, foreign governments may attempt to compel data transfers through their legal systems, potentially circumventing GDPR protections.
The article establishes that such foreign legal demands (court judgments, administrative orders, subpoenas, etc.) can only be recognized and enforced within the EU framework if they're based on international agreements like Mutual Legal Assistance Treaties (MLATs) between the requesting country and the EU or Member State. This channels government data requests through established diplomatic and legal frameworks that respect sovereignty and fundamental rights.
This provision became particularly relevant with the US CLOUD Act (2018), which allows US authorities to demand data from US companies even when stored abroad. Article 48 creates a conflict: US law demands compliance, while EU law prohibits it absent an international agreement. The EU-US Agreement on Cross-Border Access to Electronic Evidence (2019) began addressing this conflict, but tensions remain.
In practice, when an EU-established organization receives a third country data demand, they should: (1) not automatically comply, (2) assess whether it's based on a valid international agreement, (3) challenge the demand if possible, (4) notify the relevant supervisory authority and affected data subjects, and (5) document the incident. The phrase "without prejudice to other grounds for transfer" means Article 48 doesn't prevent transfers under Articles 45-47 or derogations under Article 49.
Key Points
- Third country court judgments or administrative decisions demanding data must be based on international agreements
- Cannot comply with unilateral foreign government demands without proper legal basis
- Mutual Legal Assistance Treaties (MLATs) provide proper framework
- Protects EU jurisdiction and data protection standards from foreign legal orders
- Controllers/processors should challenge improper demands and notify supervisory authorities
Practical Application
Example 1 - US Law Enforcement Request: A French cloud provider receives a subpoena from US law enforcement demanding customer data about a French citizen suspected of financial crimes. The provider checks whether the request is based on the EU-US MLAT. Finding it's a unilateral subpoena without MLAT procedures, the provider refuses compliance based on Article 48, challenges the subpoena in US court citing GDPR and jurisdictional conflicts, notifies the French supervisory authority (CNIL), and informs the affected customer. The proper channel would be for US authorities to use MLAT procedures, requesting assistance from French authorities who would evaluate the request under French and EU law.
Example 2 - CLOUD Act Conflict: The US subsidiary of a German software company receives a CLOUD Act order demanding data about EU customers stored on German servers. Article 48 creates a conflict: complying with the US order violates GDPR, but refusing violates US law. The company challenges the order in US court, arguing it should use MLAT channels. They notify their German supervisory authority, document the conflict, and explore supplementary measures like encryption that would make compliance technically impossible (data minimization as a protective measure). The case illustrates ongoing jurisdictional tensions that international agreements must resolve.
Example 3 - Valid MLAT Request: UK police investigating child exploitation request data from an Irish social media company about a suspect. Rather than demanding it directly, they submit an MLAT request through proper channels. Irish authorities evaluate the request under Irish and EU law, determine it's proportionate and necessary, obtain appropriate judicial authorization, and notify the Irish Data Protection Commission. The company can then lawfully comply, as the request is based on the EU-UK MLAT and follows proper procedures respecting Article 48.
Example 4 - Chinese National Security Law: A European manufacturer with a joint venture in China receives a demand under Chinese National Security Law to provide employee and customer data to Chinese authorities. Article 48 prohibits recognition of this demand within the EU. The company refuses to transfer data from EU servers, notifies the relevant EU supervisory authority, conducts a Transfer Impact Assessment regarding their Chinese operations under Schrems II principles, and considers whether continued operations in China are compatible with GDPR given the legal risks. They may implement data minimization (not transferring sensitive data to China) or restructure operations to separate EU and Chinese data.