As is well-known, personal data is restricted from leaving the EEA. On 21 March, the EU's Article 29 Working Party (the WP) issued draft ad hoc model clauses for data transfers from EU processors to non-EU subprocessors. While not yet approved by the EC Commission, this working document provides useful guidance on the WP's thinking on data transfers to processors which fall outside the scope of EU Decision 2010/87/EU on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC (the 2010 Clauses).
The 2010 Clauses apply to situations where an EU-based controller is transferring data to a processor based outside the EEA. In practice, the initial transfer will often be from an EU-based controller to an EU-based processor, with a subsequent transfer to a non-EU subprocessor. As the 2010 Clauses do not strictly apply to such arrangements, the guaranteed adequacy of protection is not available and alternative means for overcoming the restriction on extra-EEA data transfer must be found, e.g. valid consent by the individuals to the transfer of their data.
The draft clauses include expected restrictions, such as preventing further subprocessing activity without the controller's prior consent. They will also need to be used in conjunction with a suitable Framework Contract between the EU-based controller and processor (to satisfy Article 17 of the Directive).
The working document represents an early, though welcome, step
along the path towards Commission-approved supplementary clauses to
solve this practical problem.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.