This article was first published by IAPP in Privacy Perspectives
Although there is no universally accepted definition of international organizations in public international law, Article 4(26) of the General Data Protection Regulation describes them as “organizations and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries.” This paragraph was not contained in the original European Commission proposal for the GDPR and was introduced later by the European Council.
The statement that an international organization must be “set up by, or on the basis of an agreement between states” allows an organization given a mandate under public international law is considered subject to the requirements and rigors of the GDPR.
International organizations have different mandates, including collecting information and monitoring trends, delivering services and aid as part of humanitarian missions, conducting peaceful military exercises, or providing forums for bargaining and settling disputes.
An international organization that has been given a mandate under the public international law will process personal data precisely to accomplish that mission and mandate.
Data analytics, drones and unmanned aerial vehicles, biometrics, cloud services, and mobile messaging applications are inevitably dependent on collecting and further processing of personal data. That said, international organizations are required to implement rules to protect the processing of personal data.
In some sectors, the misuse of personal data may have life-and-death consequences. For example, the disclosure of a simple list of names of people with peace-keeping blue helmets part of an international humanitarian international may endanger their lives. Data protection laws can provide a manual for processing personal data derived from regional and international human rights standards. The lawful processing of personal data by international organizations, according to the GDPR standards, can help build trust with the individuals protected under the international organization’s missions.
Privileges and immunities under international law for organizations and their potential clashes with the GDPR
There are claims the GDPR does not apply to international organizations and that they were intended to fall outside the regulation’s scope. According to Advocate General Maciej Szpunar of the Court of Justice of the European Union, the EU law has extraterritorial effects only “in extreme situations of an exceptional nature.” The European Commission has also stated informally the GDPR does not apply to international organizations directly since they generally enjoy privileges and immunities under international law. However, the commission also maintains that the GDPR’s international data transfer rules apply to transfers from the EU to international organizations.
Alternatively, there are claims that applying the GDPR to international organizations should be determined under its material and territorial scope. The GDPR contains several exemptions from its material scope, and the legislator could have mentioned international organizations among them if it had meant to exclude them.
Under Article 44(1), transfers of EU data between international organizations only be carried out subject to the rules, indicating legislators’ concern about processing their personal data. The Court of Justice of the European Union has also found that EU law can take precedence over international law when EU fundamental rights, including data protection rights, are involved. Therefore, the argument that the GDPR intended to exclude all international organizations from its scope per se does not seem plausible.
Many international organizations are granted immunity from jurisdiction and immunity from constraint measures in the countries where they operate to protect their property and assets. When granted under a treaty, the international organization’s immunities usually relate to any of its acts.
Every act of the organization is indeed presumed to pursue the purposes of the organization. In Waite and Kennedy v. Germany and Beer and Regan v. Germany cases, the European Court of Human Rights admitted that granting privileges and immunities to international organizations have a legitimate objective. In particular, the court said, “The attribution of privileges and immunities to international organizations is an essential means of ensuring the proper functioning of such organizations free from unilateral interference by individual governments.”
Since EU law becomes part of the legal order of member states and immunities assumed in international treaties should also apply when a data protection authority or national court attempts to carry out enforcement action under the GDPR, hard enforcement by data protection authorities against the international organizations is unlikely.
Soft enforcement is more likely through informal pressure that public and private sector actors can exert against international organizations to adopt the GDPR. This may involve, for example, an EU agency requiring an international organization to comply with the GDPR as a condition for receiving funding. Or a company that provides services to an international organization demanding that it accept a clause in the services agreement stating it complies with the GDPR. Soft enforcement can be more difficult for international organizations to resist than hard enforcement.
There is usually no way to mitigate the former’s effects short of refusing to deal with the actor making the demands. Furthermore, it could be interpreted under the customary international law that in the absence of any means of redress instituted within the organization, its immunity must automatically be set aside.
Legal basis for processing personal data by the international organizations under the GDPR and the data subject rights
For international organizations in the humanitarian sector, the GDPR offers legal grounds for processing personal information, such as performance of a task carried out in the public interest (Article 6.1. e) or the processing is in the vital interests of data subjects or of another natural person (Article 6.1. d). Thus, according to Recital 46, “some types of processing may serve both important grounds of public interest and the vital interests of data subjects as for instance when processing is necessary for humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian emergencies, in particular in situations of natural and man-made disasters.”
Further, Recital 112 prescribes, “Any transfer to an international humanitarian organization of personal data of a data subject who is physically or legally incapable of giving consent, with a view to accomplish a task incumbent under the Geneva Convention or to complying with international humanitarian law applicable in armed conflicts, could be considered to be necessary for an important reason of public interest or because it is in the vital interest of the data subject.”
The GDPR requires data controllers to provide information about their dealings with international organizations and gives access rights to data subjects whose data is intended to be transferred to international organizations. Under Articles 13(1)(e) and 14(1)(f), data controllers must inform data subjects about their intention to transfer personal data to international organizations. They must provide information about the existence or absence of a commission adequacy decision covering the relevant international organization or the appropriate safeguards for the data transfer and how to obtain a copy of them.
Under Article 15(1)(c), individuals also have a right to learn from data controllers that personal data have or will be disclosed to international organizations and under Article 15(2) the appropriate safeguards that were used for the transfer. Finally, under Article 28(3)(a), data processors may only transfer personal data to international organizations based on documented instructions from the data controller, unless they are required to do so by EU or member state law.
Conclusion
Author Petruta Pirvan, Founder and Legal Counsel Data Privacy and Digital Law @EU Digital Partners
![](https://eudigitalpartners.com/wp-content/uploads/2023/07/Bday-1-150x150.jpg)