The European Data Protection Board (EDPB) adopted a final version of the Recommendations on supplementary measures following a public consultation. These recommendations aim to assist controllers and processors acting as data exporters with their duty to identify and implement appropriate supplemental measures to ensure an essentially equivalent level of protection to the data they transfer to third countries. Among the main modifications are the emphasis on examining the practices of third-country public authorities in the exporters’ legal assessment to determine whether the legislation and practices of the third country impinge – in practice – on the effectiveness of the Art. 46 GDPR transfer tool; the possibility that the exporter considers in its assessment the practical experience of the importer, among other elements and with particular caveats; and the clarification that the legislation of the third country of destination allowing its authorities to access the data transferred, even without the importer’s intervention, may also impinge on the effectiveness of the transfer tool.
https://edpb.europa.eu/system/files/2021-06/edpb_recommendations_202001vo.2.0_supplementarymeasurestransferstools_en.pdf