On February 5, 2010, the European Commission ("EC") adopted a new set of standard contractual clauses (“SCCs”) for transfers of personal data from data controllers in the EU to data processors outside of the EU. Despite the growing popularity of other mechanisms that provide a legal basis for complying with the EU legal restrictions for transferring personal data outside the EU (such as binding corporate rules), the use of SCCs remains important. Since the EU published its set of controller-to-processor clauses in 2001, the business community has recognized the need for a more pragmatic set of clauses that takes into account the rapidly-evolving climate for data processing. As global sourcing progresses and more businesses transfer data processing to companies that process data subject to an agreement with and under the control of the original data controller, the need for more pragmatic clauses has increased.
Although the EC did not adopt many of the suggestions made by the business associations, thus diluting the value of the new clauses, the new SCCs do have a few important advantages over the existing controller-to-processor clauses. For the first time in EU data protection law, the new clauses provide a legal basis for processor-to-processor transfers. Under the SCCs, such transfers may be carried out when (1) the original data controller consents in writing, and (2) the same data protection obligations are imposed on the subprocessor as are imposed on the original data importer. The original data importer remains liable for any data protection violations by the subprocessor. Another important point with regard to the new clauses is that the SCCs cover transfers from the EU to a data processor outside the EU, but not transfers from a data processor in the EU to a subprocessor outside the EU, although data protection authorities may allow use of the new clauses in such situations as well.
The decision of the European Commission updating the standard contractual clauses for the transfer of personal data to processors established in non-EU countries is available at http://tinyurl.com/y9srxuq.