Brussels, 22/01/2002 (Agence Europe) - On Tuesday the European Commission adopted a Decision setting out standard contract clauses for the transfer of personal data to processors (subcontractors) established in non-EU countries that are not recognised as offering an adequate level of data protection. The Decision simplifies the process for companies and organisations wishing or needing to transfer personal data for processing in a third country, giving them a straightforward means of complying with their obligation to ensure "adequate protection" for personal data transferred to countries outside the EU. Use of these standard contract clauses will be voluntary.
The standard contractual clauses are only one of several possibilities under the EU data protection directive for lawfully transferring personal data outside the EU. The Decision adopted on Tuesday spells out the rights and obligations of the "Data Controller" in the EU (ie any person or body determining the purposes and the means of the processing) and the "Data Processor" established in a non-EU country (ie a subcontractor processing the data on behalf of a data controller) and the necessary safeguards that both need to fulfil in order to be able to carry out the processing of personal data outside the EU. The standard contractual clauses are not compulsory for businesses. However, the advantage of using these standard clauses when transferring personal data to processors in countries outside the EU is that Member States' data protection authorities are obliged to recognise that these transfers enjoy adequate protection. The standard contractual clauses therefore add a new possibility to those already existing under the Data Protection Directive, which sets out several cases where data may still be transferred to countries whose data protection regime "not adequate". These include cases where individuals have given their unambiguous consent for data to be transferred outside the EU and where the transfer is necessary for the conclusion or performance of a contract in the interest of the data subjects. In addition, Member States' data protection authorities may authorise such transfers on a case by case basis when they are satisfied that the processing in a non-EU country enjoys "adequate protection".
Contract clauses are not necessary for the transfer of personal data within the EEA (European Economic Area EU, plus Iceland, Norway and Liechtenstein), to countries whose data protection regimes have been recognised by the Commission as offering adequate protection (so far, Switzerland, Hungary and Canada), or to US companies adhering to the 'Safe Harbour' Privacy Principles issued by the US Department of Commerce.