On 26 November 2014, the Article 29 Data Protection Working Party (the "Working Party"), an independent European advisory body on data protection and privacy comprised of representatives from the national data protection authorities of the EU Member States ("DPA"), the European Data Protection Supervisor and the European Commission, adopted a working document that establishes a co-operation procedure for issuing common opinions on contractual clauses considered to be compliant with the European Commission's Model Clauses (the "Working Document").
In the framework of Article 26.2 of Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Data Protection Directive"), companies may make use of contractual clauses to adduce sufficient safeguards to effect international transfers of personal data from the European Economic Area (the "EEA") to third countries. To facilitate the use of such contractual clauses, the European Commission previously issued three decisions on standard contractual clauses, known as the Model Clauses: Decision 2001/497/EC and Decision 2004/915/EC on transfers between data controllers and Decision 2010/97/EU on transfers from data controllers to data processors.
Most contracts currently used by companies to ensure compliance of international transfers are either entirely based on the Model Clauses or incorporate the Model Clauses with additional provisions. In some situations, companies use identical clauses in different Member States to frame the same or similar types of transfers starting from those different Member States, e.g. when data systems of a corporate group are centralised outside the EEA and the same set of contractual clauses are signed by the different EU subsidiaries.
Most EU Member States require that a contractual clause should obtain a national permission or prior authorisation. At present, different DPAs may thus have to analyse the same contract in order to assess its compliance with a model clause, which may lead to a different outcome in distinct Member States. In order to streamline the process of obtaining the necessary approvals to transfer data outside the EEA, the Working Document proposes a co-operation procedure between national DPAs with the purpose of obtaining a common opinion.
The co-operation procedure starts with the selection of a so-called "Lead DPA". The Lead DPA is the authority of one of the data exporting Member States which is considered to be the most appropriate DPA. The working party lists a number of relevant criteria, such as the location from which the contractual clauses are decided and elaborated.
Next, the Lead DPA will review the contractual clause and will send its analysis to the (co-)reviewer(s). If the contract will be used in less than 10 countries, only 1 DPA will be involved as a reviewer. If there will be 10 or more Member States from which transfers are to take place, 2 DPAs will be appointed. Once the Lead DPA and the (co-)reviewer(s) have reached a consensus, their decision will be communicated to the other competent DPAs.
The DPAs have set up a voluntary system of mutual recognition. The DPAs that are part of this mutual recognition process will be deemed to accept the decision of the Lead DPA and the (co-)reviewer(s), whilst the other competent DPAs can provide their comments within one month. When the Lead DPA, the (co-)reviewer(s) and the DPAs that are not part of the mutual recognition procedure have agreed on the contractual clause, the company will be informed of the positive decision.
Even where the cooperation procedure has led to a favourable common opinion, a company will still be required to obtain the necessary permits or authorisations at national level. There may also be other national requirements, such as notifications or administrative formalities. However, the Working Document indicates that a favourable common opinion will be taken into consideration by national DPAs when deciding whether to provide a national permit or authorisation for an international data transfer.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
