EU: Commission introduces new standard contractual clauses

The European Commission originally issued standard contractual clauses for data processing in so-called third countries, which may be applied by companies. It was agreed on 02/05/2010 to revise these clauses.

Today, companies have much of their data processed abroad. As far as this is done within the EU or by a US company that has signed the Safe Harbor Agreement, no further contractual arrangements are necessary. The same applies for countries whose data protection regulations comply with European standards. The latter is recognized in European Economic Area countries - the EU - as well as in Iceland, Norway and Lichtenstein, and also in Switzerland, Argentina, Canada, Isle of Man, Jersey and Guernsey.

However, if data is processed in any other countries (so-called third countries), the newly formulated standard contractual clauses may be applied. One new feature is in particular a regulation according to which, under certain conditions, processing activities may be assigned to subcontractors, provided that personal data remains protected. In this case, the most important requirement is the consent of the company that originally collected the data. If no consent is given, it is forbidden for subcontractors to carry out processing work. In addition, the same strict data protection regulations that apply for the main contractor shall also apply for subcontractors outside the EU.

Initially, this decision made by the commission has no consequences for companies. Pre-existing contracts shall remain valid without modification. However, should a company wish to authorize subcontracting or make any other amendments to the contract, a new contract including the revised clauses must be concluded. Companies are at liberty to use their own set of agreements for data processing in third countries, but these must be approved by the national Data Protection Regulatory Authorities. It may well be easier in this case to revert to pre-determined clauses, as these do not require extensive examination by the Regulatory Authorities. However, it is important that the standard contractual clauses are applied unaltered as each alteration requires examination and authorization by the Regulatory Authorities.