European Commission Approves New Set of Standard Clauses for Data Transfers

The European Commission has approved a new set of model contract clauses ("Clauses") 1 for the transfer of personal data from the European Union 2 to other countries. By incorporating the Clauses into a contract between the organization exporting the data and the data importer, the parties can ensure adequate safeguards for data transfers as required under the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("Directive"). 3

The Clauses, submitted by a business coalition in 2000, 4 will be available for use as of April 1, 2005. They are intended to provide businesses with a wider choice of compliance options, in addition to the contract clauses already available under the Commission's June 2001 decision ("Commission Decision"). 5 A comparison of the provisions of the Clauses to those of the Commission Decision, provided below, suggests that these two sets of contract clauses are more similar than they are different.

Background

Rules For Data Transfers to Third Countries

Before reviewing the Clauses, it is important to understand the rules governing data transfers to third countries under the Directive. The Directive restricts cross-border transfers to third countries that have been found to ensure an "adequate" level of protection (Article 25). To date, the European Commission has deemed adequate the laws of Argentina, Canada, Guernsey, Hungary, and Switzerland. In addition, companies that certify to the U.S. Safe Harbor principles, and the Passenger Name Record of air passengers transferred to the United States' Bureau of Customs and Border Protection have also been deemed to be adequate.

The Directive provides several exceptions that allow for international transfers of personal information where there is no "adequacy" determination in place for the relevant jurisdiction, including where: (i) the data subject has given his or her unambiguous consent; (ii) the transfer is necessary for the performance of the contract with the individual; or (iii) the controller has entered into an appropriate contract, which, if individually negotiated, requires approval of the Member State Data Protection Authority, or which incorporates the clauses in the 2001 Commission Decision. In addition, privacy experts, the EU data protection commissioners and the European Commission are working on the use of codes of conduct or "Binding Corporate Rules" as an alternative...