Commission approves contracts for international data transfers

The European Commission has approved of a new set of standard contractual clauses for international data transfers proposed by seven international business associations. The contracts are said to offer an adequate level of data protection under the EU’s data protection laws. Companies can use the clauses to provide a legal basis for transfers to data controllers outside of Europe as from 1 April 2005. The new clauses will be added to those already available under the Commission’s June 2001 decision (IP/01/851).

Companies believe that some of the new clauses, such as those on litigation, allocation of responsibilities or auditing requirements, are more business-friendly. According to the Commission the new clauses provide for a similar level of data protection as those of 2001 and prevent abuses, the data protection authorities are given more powers to intervene and impose sanctions where necessary. The implementation of this new set of clauses will be reviewed in 2008.

A big coalition of business associations led by the International Chamber of Commerce (ICC) negotiated these new standard contractual clauses with the Commission and the Article 29 Working Party over the last three years. It marks the first time the Commission has officially approved a mechanism for data transfers proposed by the private sector.

According to the ICC the clauses provide a number of advantages for companies over the Commission’s previous clauses. For instance, the clauses do not require the data exporter and data importer to be liable for each other’s misuse of the data. The ICC call the new clauses more “flexible and realistic” for businesses.

The new clauses limit the right of access for data subjects. Access can be denied for requests “which are obviously abusive based on unreasonable intervals or their number or repetitive or systematic nature, or for which access need not be granted under the law of the country of the Data Exporter”.

European Union approves clauses for international data transfers (07.01.2005)
http://www.iccwbo.org/home/news_archives/2005/data_transfers.asp

Commission: Model Contracts for the transfer of personal data to third countries
http://europa.eu.int/comm/internal_market/privacy/modelcontracts_en.htm

Article 29 opinion on draft clauses (17.12.2003)
http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2003/wp84_en.pdf