On March 21 2014, the Article 29 Working Party (the “Working Party”) issued Working document 01/2014 on Draft Ad hoc contractual clauses “EU data processor to non-EU sub-processor" (the “Working Document”), which contains draft ad-hoc contractual clauses for transfers of personal data from data processors in the EU to data sub-processors outside the EU, (i.e. where personal data initially transferred by a controller to a processor within the EU and is then transferred by the processor to a “sub-processor” outside the EU.) Please click here to view the Working Document.
Currently, Standard Contractual Clauses (“SCCs”) are the principle tool employed by the EU to ensure compliance with restrictions on the transfer of data outside the EU. However, these only apply to transfers of personal data from data controllers in the EU to data processors outside the EU. The Working Document provides a set of contractual clauses which will apply to transferring personal data from data processors in the EU to other data processors outside the EU.
The key provisions under the draft model clauses for data processors include:
- Framework Contract
- List of sub-processing agreements
- Third party beneficiary clause
- Disclosure of the Framework Contract
- Termination of the Framework Contract
Please note, however, these draft model clauses are not yet official. The Working Document is now in the hands of the European Commission which must decide whether to amend the existing SCCs to reflect these changes or supplement them with the new clauses. It is yet to be seen what impact changes like these will have, but as we move more generally towards a more uniform, harmonised approach of applying EU national rules for international data transfers, they are likely to prove instrumental, particularly, for example, in the ever-growing arena of cloud services.