The European Commission has approved a new set of model contract clauses ("Clauses") [fn1] for the transfer of personal data from the European Union [fn2] to other countries. By incorporating the Clauses into a contract between the organization exporting the data and the data importer, the parties can ensure adequate safeguards for data transfers as required under the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ("Directive"). [fn3]
The Clauses, submitted by a business coalition in 2000, [fn4] will be available for use as of April 1, 2005. They are intended to provide businesses with a wider choice of compliance options, in addition to the contract clauses already available under the Commission's June 2001 decision ("Commission Decision"). [fn5] A comparison of the provisions of the Clauses to those of the Commission Decision, provided below, suggests that these two sets of contract clauses are more similar than they are different.
Rules For Data Transfers to Third Countries
Before reviewing the Clauses, it is important to understand the rules governing data transfers to third countries under the Directive. The Directive restricts cross-border transfers to third countries that have been found to ensure an "adequate" level of protection (Article 25). To date, the European Commission has deemed adequate the laws of Argentina, Canada, Guernsey, Hungary, and Switzerland. In addition, companies that certify to the U.S. Safe Harbor principles, and the Passenger Name Record of air passengers transferred to the United States' Bureau of Customs and Border Protection have also been deemed to be adequate.
The Directive provides several exceptions that allow for international transfers of personal information where there is no "adequacy" determination in place for the relevant jurisdiction, including where: (i) the data subject has given his or her unambiguous consent; (ii) the transfer is necessary for the performance of the contract with the individual; or (iii) the controller has entered into an appropriate contract, which, if individually negotiated, requires approval of the Member State Data Protection Authority, or which incorporates the clauses in the 2001 Commission Decision. In addition, privacy experts, the EU data protection commissioners and the European Commission are working on the use of codes of conduct or "Binding Corporate Rules" as an alternative for ensuring adequate data protection without the need to establish and maintain contracts.
Comparison of the Clauses and the Commission Decision
In the following we briefly summarize the salient points and highlight the main differences between the Clauses and the Commission Decision.
While the Commission Decision provides for joint and several liability (Clause 6), the Clauses (Clause III) only require each party to be liable for the damages it causes. To compensate for lack of joint and several liability, however, the Clauses (Clause Ib) contain a due diligence clause that requires the exporter to guarantee that it "used reasonable efforts to determine that the importer is able to satisfy the requirements established by the Clauses." This provision, therefore, could create similar liability for the data exporter for damages caused by the importer where the exporter was found to be in breach of its due diligence obligations (culpa in eligendo).
The Commission Decision (Clause 5d) mandates that the importer submit the data processing facilities, upon the exporter's request, for an audit executed by either the exporter or any independent third party. The exporter may select the members, where applicable in agreement with the supervisory authority.
In comparison, the Clauses are more in line with standard industry practice audit provisions. The Clauses (Clause IIg) also afford the choice of the auditors to the exporter and require the necessary consent or approval from the EU regulator, but they allow the audit to be done by the exporter or an independent third party. In addition, the Clauses require reasonable notice and allow the audit only during regular business hours. It is unclear, however, how the data protection authorities in practice will interpret this provision.
The Commission Decision (Clauses 8 and 5c) requires that the importer cooperate with the competent supervisory authorities and abide by their advice while the Clauses (Clause V) only require the parties to warrant that they will cooperate with the supervisory authority. The Commission Decision (Clause 7) requires the data importer to agree to accept the decision of the data subject to refer the matter to arbitration or mediation or the relevant court. Under the Clauses (Clause V), the parties also agree to respond to any non-binding mediation procedure initiated by the data subject, but need only consider participating in arbitration and other data protection dispute resolution mechanisms. The data importer, however, must agree to abide by the decision of a competent court, which is final.
It is unclear if the Clauses are any less likely than the Commission Decision to create jurisdiction for the importer. Under the Commission Decision, agreeing to accept the decision of the data subject to refer the matter to the relevant court appears to amount to submitting to jurisdiction. Agreeing to an audit, to cooperate with the authorities, to respond to a non-binding procedure, and to abide by a decision of a competent court, however, may also be tantamount to the importer submitting to jurisdiction in Europe.
Another and perhaps more significant difference between the Commission Decision and the Clauses is that under the Clauses the data protection authorities have greatly increased enforcement powers and can more easily prohibit or suspend data transfers. In particular, transfers based on the Clauses may be prohibited where the data exporter refuses to take appropriate steps to enforce contractual obligations against the data importer or the latter refuses to co-operate in good faith with the competent (EU) authorities (Article 1.2, recital 7).
Third Party Beneficiary Rights
The Commission Decision (Clause 3) creates third party beneficiary rights in data subjects, allowing them to enforce certain provisions of the agreement, presumably against both parties. The Clauses, in contrast, permit the data subject to take enforcement actions against the importer but only if the exporter does not take an enforcement action against the importer within a reasonable time. The Clauses indicate that, under normal circumstances, the exporter must take action and resolve any complaint within one month. Although it is not clear how this provision would operate, it appears that the data subject could put the exporter on notice of an enforcement problem and if the exporter does not act, proceed directly against the importer. In cases involving exporters and importers that are not affiliated, it is not clear how much insulation from third party beneficiary suits the Clauses would provide to the importer. Non-affiliated exporters would appear to have little incentive to proceed against the importer.
The onward transfer requirements in the Clauses and the Commission Decision are essentially equivalent. The Commission Decision (Annexes 2 and 3) generally prohibits onward transfers to non-EU entities unless the third party recipient is subject to an adequacy decision (e.g., by joining the Safe Harbor) and the additional requirements annexed to the Commission Decision are fulfilled; the third party recipient contractually assumes the same obligations as the importer; or the data subject's consent is obtained. The Clauses (Clause IIi) provide for the same restrictions. In particular, compliance with either Member State law or the provisions of an adequacy determination (e.g., Safe Harbor) is insufficient; additional restrictions must be fulfilled.
Technical and Organizational Measures
With respect to technical and organizational measures, the Commission Decision requires that these measures be implemented prior to the transfer and that the measures correspond to Member State law applicable to contractual clauses. The Clauses (Clause IIa) state that the importer will have in place measures to protect the data against accidental loss, alteration, disclosure, etc. No reference to Member State legislation is made.
There are few significant differences between the newly adopted Clauses and the Commission Decision. This conclusion is shared by the Commission. In its "Frequently Asked Questions" ("FAQs") published together with the Clauses, the Commission stated that "Both Clauses provide for a similar level of data protection, in other words, individuals are similarly protected by both sets on the bases of the same (adequate) data protection standards and principles. Differences between both sets are mainly of a technical nature." In addition, the Clauses do not advance the issues raised by organizations regarding the complexities and administrative difficulties associated with relying on contracts as an adequacy mechanism. Those problems remain as acute.
1: Commission Decision (December 2004) amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46, C(2004)5271.
2: Any reference to Europe or the European Union (EU) should be understood as referring to the territory of its Member States, i.e., Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Slovakia, Slovenia, Spain, Sweden, and the United Kingdom. The three European Economic Area (EEA) member states Iceland, Liechtenstein, and Norway have also enacted the EU regulatory privacy regime.
4: The International Chamber of Commerce, Federation of European Direct Marketing Associations, EU Committee of the American Chamber of Commerce in Belgium, Confederation of British Industry, European Information and Communications Technology Association, Japan Business Council in Europe, and the International Communication Round Table.
5: The Commission Decision of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC (2001/497/EC), published in the Official Journal of the European Communities on July 4, 2001, L 181/19, incorporates the standard terms suggested by the European Commission for transfers to so-called controllers ("Standard clauses for Controllers").