Article 4 Free movement of data within the Union

1.   Data localisation requirements shall be prohibited, unless they are justified on grounds of public security in compliance with the principle of proportionality.

The first subparagraph of this paragraph is without prejudice to paragraph 3 and to data localisation requirements laid down on the basis of existing Union law.

2.   Member States shall immediately communicate to the Commission any draft act which introduces a new data localisation requirement or makes changes to an existing data localisation requirement in accordance with the procedures set out in Articles 5, 6 and 7 of Directive (EU) 2015/1535.

3.   By 30 May 2021, Member States shall ensure that any existing data localisation requirement that is laid down in a law, regulation or administrative provision of a general nature and that is not in compliance with paragraph 1 of this Article is repealed.

By 30 May 2021, if a Member State considers that an existing measure containing a data localisation requirement is in compliance with paragraph 1 of this Article and can therefore remain in force, it shall communicate that measure to the Commission, together with a justification for maintaining it in force. Without prejudice to Article 258 TFEU, the Commission shall, within a period of six months from the date of receipt of such communication, examine the compliance of that measure with paragraph 1 of this Article and shall, where appropriate, make comments to the Member State in question, including, where necessary, recommending the amendment or the repeal of the measure.

4.   Member States shall make the details of any data localisation requirements laid down in a law, regulation or administrative provision of a general nature and applicable in their territory publicly available via a national online single information point which they shall keep up-to-date, or provide up-to-date details of any such localisation requirements to a central information point established under another Union act.

5.   Member States shall inform the Commission of the address of their single information point referred to in paragraph 4. The Commission shall publish the link(s) to such point(s) on its website, along with a regularly updated consolidated list of all data localisation requirements referred to in paragraph 4, including summarised information on those requirements.