On 26 November 2014, the Article 29 Working Party adopted a working document on establishing a cooperation procedure for issuing common opinions on whether contractual clauses are compliant with the European Commission’s Model Clauses (Model Clauses).
The working document establishes the procedure in which companies wishing to use identical contractual clauses in different Member States for transfers of personal data outside the European Economic Area (EEA) are able to obtain a coordinated position from the relevant Data Protection Authorities (DPA) on the proposed contracts, without the need to approach each relevant DPA individually for approval.
Background
Model Clauses represent one of the ways that a data controller can overcome the general prohibition contained in the EU Data Protection Directive (95/46/EC) on cross-border transfers of personal data to countries outside the EEA that do not offer adequate levels of data protection. The Model Clauses are intended to be used without amendment – although some divergence, e.g., through the use of additional clauses having no impact on the overall compliance of the Model clauses adopted, may be acceptable.
Company groups in Europe often use identical contractual clauses in different jurisdictions for the purposes of transfers out of the EEA. However, differing implementation of the Data Protection Directive between Member States has resulted in the situation whereby some jurisdictions require DPA approval of the Model Clauses used (such as Austria, Denmark, France and Spain), whether used with or without amendment, whereas other jurisdictions do not require such DPA approval where the Model Clauses are used without amendment. The result of the above is that it may be possible that identical contracts using the Model Clauses with only minor amendment are considered compliant by a DPA in one jurisdiction but not in others.
According to the Working Party, the purpose of this working document is to create a procedure allowing companies to obtain a coordinated position from the relevant DPAs when using identical contractual clauses based on the Model Clauses with minor amendment, in particular as to whether the contractual clauses are compliant with the Model Clauses.
The Process
Should a company wish to know whether its contract is compliant with the Model Clauses, under the proposed cooperation procedure, it will first need to ask the DPA it believes is entitled to act as the lead DPA to launch the EU cooperation procedure.
The company will then need to provide the lead DPA a copy of the contract, indicating the references to the Model Clauses together with any divergences and additional clauses, as well a list of EEA countries from which the company will be carrying out the transfers.
The Lead DPA
The Working Party has suggested that the company should choose the lead DPA from a Member State in which the transfers will take place and it will be for the company to justify why the DPA should be considered the lead. According to the Working Party, the following criteria should be considered by the company:
- The location from which the contractual clauses are decided and elaborated;
- The place where most decisions, in terms of the purposes and the means of the processing, are taken;
- The best location, in terms of management functions, administrative burden, etc., for the handling of the application and the enforcement of the contractual clauses;
- The Member States within the European Union from which most transfers outside the EEA will take place; and
- The location of the group’s European headquarters or the location of the company within the group with delegated data protection responsibilities.
The lead DPA will then have two weeks to respond to the company and accept the role of lead DPA. If it accepts the role, it will forward all information to the other DPAs that will be involved in the process and identify the proposed reviewer DPAs.
The reviewer DPAs will need to respond to the lead DPA indicating whether they accept their roles and the lead DPA will be in charge of considering if the proposed contract is in conformity with the Model Clauses.
The Cooperation Procedure
Once the lead DPA has established whether the proposed contract is compliant with the Model Clauses, it will prepare a draft letter that it will share with the reviewers. The reviewers will have one month to consider the letter and provide any comments. The letter will then be sent to the other relevant DPAs, who will have one month to respond with any comments. Should there be no response from these DPAs, they will be deemed to have agreed to the draft letter.
Once the process is complete, the lead DPA will sign the letter on behalf of the other DPAs and send the letter to the company, specifying whether the proposed contract conforms to the Model Clauses. From this point, the EU cooperation procedure is closed and the letter will be taken into consideration as a basis for providing the necessary national authorisations or permits from the relevant national bodies.
Comment
This process should be welcomed at least as an attempt to ease the administrative burden on data controllers when they wish to transfer personal data overseas. Under the process, data controllers will be able to obtain a common position from the relevant DPAs in the jurisdictions affected through a single point of contact, which should provide some comfort. However, it should be noted that a positive letter from the lead DPA will not dispense of the need to obtain DPA authorisations from those jurisdictions that require as such by law, nor necessarily guarantee that such authorisations will be granted. Furthermore, it remains to be seen whether this will actually streamline the process or add further to delays.
