5.

By way of derogation from paragraph 1, the Executive Director may authorise the transfer of personal data to third countries or international organisations on a case-by-case basis if the transfer is: necessary in order to protect the vital interests of the data subject or of another person; necessary to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides; essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country; necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions; or necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence or the execution of a specific criminal sanction. Personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e). Derogations may not be applicable to systematic, massive or structural transfers.

← art_25__para_4__text_1 · All articles · art_25__para_5__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.