The Report provides for a specific legal regime regarding data transfers to non-EU public authorities, and requires companies to obtain the prior approval of DPAs when seeking to disclose data in response to a court or other legal order issued in a third country.