Privacy & Information Security Law Blog

On November 26, 2014, the Article 29 Working Party (the “Working Party”) released a Working Document providing a cooperation procedure for issuing common opinions on whether “contractual clauses” comply with the European Commission’s Model Clauses (the “Working Document”).

The Working Document creates a cooperation procedure that enables companies who utilize contractual clauses, or the amended European Commission-approved Model Clauses (the “Company’s Clauses”), in different EU Member States to obtain the opinion of the competent data protection authorities (“DPAs”) regarding the compliance of the Company’s Clauses with local law. Article 26(2) of EU Data Protection Directive 95/46/EC (the “Directive”) allows DPAs to authorize contractual clauses as a means of offering adequate safeguards for the international transfer of personal data from the EU to non-EU jurisdictions. The European Commission previously had issued decisions (and templates) authorizing three sets of contractual clauses (known as the “Model Clauses”). Two of these decisions regulate transfers from data controllers to data controllers, and the third regulates transfers from data controllers to data processors. Controllers also are permitted to prepare their own ad hoc clauses, or amend the Model Clauses, provided they are approved by relevant DPAs.

In addition to the approval of ad hoc clauses, in many EU Member States, authorizations are required for Model Clauses, regardless of whether they have been amended. Jurisdictions that require such authorization include Austria, Bulgaria, Cyprus, Denmark, Estonia, France, Lithuania, Luxembourg, Malta, Poland, Romania, Slovenia and Spain, although an amendment to the law in Poland is scheduled to take effect on January 1, 2015.

In an attempt to streamline this approval process, the Working Document proposes the appointment of a Lead DPA to opine on whether the proposed contractual clauses conform to the Model Clauses. If the opinion of the Lead DPA is favorable, other DPAs will take the Lead DPA’s opinion into account when granting authorizations as required by their respective local laws. The process of mutual recognition will be similar to the system by which DPAs approve Binding Corporate Rules.

Selection of a Lead DPA

The Lead DPA for the cooperation procedure must be in an EU Member State from which the transfers will take place and the company must justify why it selected a particular DPA as the Lead DPA. The Working Document indicates that the following factors may be relevant:

• the location from which the Company’s Clauses are decided and elaborated;
• the place where most decisions in terms of the purposes and the means of the processing are taken;
• the best location (in terms of management functions, administrative burden, etc.) for the handling of the application and the enforcement of the Company’s Clauses;
• the Member States within the EU from which most transfers outside the EEA will take place; and
• the location of the group’s European headquarters or the location of the company within the group with delegated data protection responsibilities.

Procedure for Obtaining DPA Opinion and Mutual Recognition

The procedure for obtaining an opinion on the compliance of the Company’s Clauses is as follows:

• The Company selects a Lead DPA and reviewers, and submits its application and the Company’s Clauses. The company must list the EEA countries from which data will be transferred.
• Within two weeks of receipt of the application, the Lead DPA will indicate whether it is willing to act as Lead DPA. If so, it will simultaneously forward the information to all competent DPAs (i.e., the DPAs in all countries from which transfers will take place) and identify the proposed reviewer DPA(s).
• The proposed reviewer DPA(s) will indicate whether they agree to act as reviewers. The Lead DPA will be responsible for analyzing whether the Company’s Clauses conform to the Model Clauses.
• Once the Lead DPA considers that the proposed contractual clauses are in conformity with the Model Clauses, it will provide a draft letter, the Company’s Clauses and its analysis to the co-reviewer(s), who should review the draft letter within a month.
• The analysis and the Company’s Clauses will be communicated to the other competent DPAs.
• DPAs who are part of the mutual recognition process will acknowledge receipt of the documentation and, when the draft letter indicates that the Company’s Clauses are in conformity with the Model Clauses, it will accept this opinion as a sufficient basis for providing their own national permit or authorization for the proposed model clauses (as required by local law).
• DPAs that are not part of the mutual recognition process will have one month to comment on the draft letter. If there is no answer from those DPAs within the given timeframe, they will be deemed to have agreed to the draft letter.