The appropriate safeguards referred to in paragraph 1 may be provided for , without requiring any specific authorisation from the European Data Protection Supervisor , by : ( a ) a legally binding and enforceable instrument between public authorities or bodies