Schedules Schedule 7: Transfers of personal data to third countries etc: general processing Transfers subject to appropriate safeguards
Paragraphs 6 to 8 of Schedule 7 amend Article 46 and 47 of the UK GDPR and introduces new Article 47A.
	Paragraph 6(1) is self-explanatory.
	Paragraph 6(2) omits Article 46(1), which provided that, in the absence of adequacy regulations, a controller or processor could transfer personal data to a third country or international organisation only if they provided appropriate safeguards and on condition that enforceable data subject rights and effective legal remedies were available. Articles 46(2) and (3) provided further detail on how appropriate safeguards could be provided.
	Paragraph 6(3) inserts new Article 46(1A) and provides that a transfer of personal data is made to a third country or international organisation subject to appropriate safeguards only if:
Safeguards (i.e. the transfer mechanisms described in Articles 46(2) or (3), such as standard data protection clauses specified in a document issued by the ICO, or specified in regulations pursuant to new Article 47A(4)) are provided in connection with the transfer. If the safeguards are provided by a legally binding and enforceable instrument between a UK public body and another person or persons (under Article 46(2)(a)), the transfer must be consistent with the intended scope of that instrument; and each UK public body that is a party to the instrument, acting reasonably and proportionately in the circumstances, considers that the data protection test is met in relation to the transfers or types of transfers which is intended to be made in reliance on the instrument;
Where the safeguard is a mechanism described in Article 46(2)(b) - (f), (3)(a) -(b) or specified in regulations pursuant to new Article 47A(4), the controller or processor, acting reasonably and proportionately, considers that the data protection test is met in relation to the transfer or type of transfer.
	Paragraphs 6(4)(a)(i), (e) and (f) of Schedule 7 make consequential amendments to Article 46(2) to clarify that the word ‘safeguards’ refers only to the transfer mechanisms listed in Article 46(2), the use of which is only appropriate in all the circumstances if the controller, processor or public body that is party to the instrument, acting reasonably and proportionately, considers that the data protection test is met. Paragraph 6(4)(c) makes a clarificatory amendment to confirm that binding corporate rules provide safeguards for the purposes of new Article 46(1A) only if they are approved pursuant to Article 47. Paragraphs 6(4)(a)(ii), (b) and (d) are self-explanatory.
	Paragraph 6(5)(a) makes a consequential amendment to Article 46(3) to clarify that the word ‘safeguards’ refers only to the transfer mechanisms listed in Article 46(3), the use of which is only appropriate in all the circumstances if the controller or processor, acting reasonably and proportionately, considers that the data protection test is met.
	Paragraph 6(6) introduces the new data protection test in new Article 46(6), which the controller, processor or UK public body that is party to the instrument, acting reasonably and proportionately, must consider is met before a transfer under Article 46 may take place. The data protection test is met if, after the personal data being transferred has reached its destination, the standard of protection provided for the data subject (by the safeguards and other means, where relevant) would not be lower than the standard of protection under the UK GDPR and relevant parts of the DPA 2018 in a way which is material.
	Paragraph 6(6) also introduces new Article 46(7), which provides more detail about what it means to act reasonably and proportionately. It clarifies that the actions of a controller, processor or UK public body that is party to an instrument must be reasonable and proportionate in all the circumstances (or likely circumstances) of the transfer (or types of transfer) - this includes considering the nature and volume of the personal data being transferred. This process is distinct to that which the Secretary of State undertakes under Articles 45A and B. It is tailored for the purposes of controllers or processors (or public bodies that are parties to an instrument under Article 46(2)(a)), and recognises that the transfer mechanisms in existing Articles 46(2) and (3) or specified in regulations pursuant to new Article 47A(4) include inherent protections for the rights of data subjects.
	Finally, paragraph 6(6) introduces new Article 46(8), which:
Clarifies that references to the protection for the data subject are to that protection taken as a whole; and
Introduces the definition of a ‘relevant person’ to distinguish from public bodies as defined in Article 4(10A). A ‘relevant person’ for the purposes of existing Articles 46(2)(a) and 3(b) means a public body or another person (including an international organisation) exercising functions of a public nature.
	Paragraph 7 is self-explanatory.