94
The first sentence of Article 45(1) of the GDPR provides that a transfer of personal data to a third
country may be authorised by a Commission decision to the effect that that third country, a territory or
one or more specified sectors within that third country, ensures an adequate level of protection. In that
regard, although not requiring a third country to ensure a level of protection identical to that guaranteed
in the EU legal order, the term ‘adequate level of protection’ must, as confirmed by recital 104 of that
regulation, be understood as requiring the third country in fact to ensure, by reason of its domestic law
or its international commitments, a level of protection of fundamental rights and freedoms that is
essentially equivalent to that guaranteed within the European Union by virtue of the regulation, read in
the light of the Charter. If there were no such requirement, the objective referred to in the previous
paragraph would be undermined (see, by analogy, as regards Article 25(6) of Directive 95/46,
judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650, paragraph 73).
95
In that context, recital 107 of the GDPR states that, where ‘a third country, a territory or a specified
sector within a third country … no longer ensures an adequate level of data protection. … the transfer
of personal data to that third country … should be prohibited, unless the requirements [of that
regulation] relating to transfers subject to appropriate safeguards … are fulfilled’. To that effect,
recital 108 of the regulation states that, in the absence of an adequacy decision, the appropriate
safeguards to be taken by the controller or processor in accordance with Article 46(1) of the regulation
must ‘compensate for the lack of data protection in a third country’ in order to ‘ensure compliance with
data protection requirements and the rights of the data subjects appropriate to processing within the
Union’.
96
It follows, as the Advocate General stated in point 115 of his Opinion, that such appropriate
guarantees must be capable of ensuring that data subjects whose personal data are transferred to a third
country pursuant to standard data protection clauses are afforded, as in the context of a transfer based
on an adequacy decision, a level of protection essentially equivalent to that which is guaranteed within
the European Union.
97
The referring court also asks whether the level of protection essentially equivalent to that guaranteed
within the European Union must be determined in the light of EU law, in particular the rights
guaranteed by the Charter and/or the fundamental rights enshrined in the European Convention for the
Protection of Human Rights and Fundamental Freedoms (‘the ECHR’), or in the light of the national
law of the Member States.
98
In that regard, it should be noted that, although, as Article 6(3) TEU confirms, the fundamental rights
enshrined in the ECHR constitute general principles of EU law and although Article 52(3) of the
Charter provides that the rights contained in the Charter which correspond to rights guaranteed by the
ECHR are to have the same meaning and scope as those laid down by that convention, the latter does
not constitute, as long as the European Union has not acceded to it, a legal instrument which has been
formally incorporated into EU law (judgments of 26 February 2013, Åkerberg Fransson, C‑617/10,
EU:C:2013:105, paragraph 44 and the case-law cited, and of 20 March 2018, Menci, C‑524/15,
EU:C:2018:197, paragraph 22).
99
In those circumstances, the Court has held that the interpretation of EU law and examination of the
legality of EU legislation must be undertaken in the light of the fundamental rights guaranteed by the
Charter (see, by analogy, judgment of 20 March 2018, Menci, C‑524/15, EU:C:2018:197,
paragraph 24).
100
Furthermore, the Court has consistently held that the validity of provisions of EU law and, in the
absence of an express reference to the national law of the Member States, their interpretation, cannot
be construed in the light of national law, even national law of constitutional status, in particular
fundamental rights as formulated in the national constitutions (see, to that effect, judgments of
17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of
13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis,
C‑135/15, EU:C:2016:774, paragraph 28 and the case-law cited).
101
It follows that, since, first, a transfer of personal data, such as that at issue in the main proceedings, for
commercial purposes by an economic operator established in one Member State to another economic