Recital 4

(4)In order to ensure a level of protection of personal data that is in line with Regulation (EU) 2016/679 of the European Parliament and of the Council ² , any transfer of personal data to third countries should be undertaken in full compliance with that regulation. One such way to exchange personal data between competent authorities and supervisory authorities of third countries is through administrative arrangements ensuring appropriate safeguards pursuant to Article 46(3) of by Regulation (EU) 2016/679, which include enforceable and effective rights that natural persons have over their personal data. For the transfer of personal data between European Economic Area (‘EEA’) financial supervisory authorities and non-EEA financial supervisory authorities, such an administrative arrangement has been drafted by the International Organization of Securities Commissions (IOSCO) and the European Securities and Markets Authority (ESMA) ³ , and received the positive opinion of the European Data Protection Board (EDPB) ⁴ . All EEA financial supervisory authorities and a number of non-EEA financial supervisory authorities have signed the ESMA-IOSCO administrative arrangement. In light of the broad institutional consensus around personal data safeguards provided in the ESMA-IOSCO administrative arrangement, it provides a model for future similar arrangements framing the transfer of personal data between competent authorities and supervisory authorities of third countries which are not parties to the ESMA-IOSCO Administrative Arrangement. However, authorities of Member States using the model ESMA-IOSCO Administrative Arrangement would still need to obtain authorisation by the data protection authority pursuant to Article 46(3) of Regulation (EU) 2016/679.