The Article 29 Data Protection Working Party (Working Party) released a Working Document setting forth a co-operation procedure for issuing common opinions on “Contractual clauses” considered as compliant with the EC Model Clauses (Working Document). The aim of this Working Document is to facilitate the use of the EU model clauses across multiple jurisdictions in Europe, while ensuring a harmonised and consistent approach to the way these model clauses are approved by the national Data Protection Authorities (DPAs).
There is currently a patchwork of authorisation and registration procedures among the national DPAs. When assessing a particular set of model clauses, one DPA may reach a different conclusion from another, resulting in uncertainty and legal risk for organisations.
Under the new co-operation procedure, the Working Party hopes to streamline the approval process, with the appointment of a Lead DPA deciding whether the proposed contractual clauses conform to the Model Clauses. Reasons for selecting a particular DPA as the Lead DPA include, among others, ‘the location from which the Company’s Clauses are decided and elaborated’, and ‘the place where most decisions in terms of the purposes and the means of processing are taken’.
Once the Lead DPA is satisfied that the contract complies with the EU Model Clauses, the Lead DPA will draft a letter to the co-reviewer(s) to review within the next month (two co-reviewers must be appointed in the event of the data being transferred from more than 10 Member States).
The principal concern with this procedure is that the proposed contract is only reviewed for its compliance with the EU model clauses. Further steps may still be needed to comply with national laws, such as the supporting documentation requirements in Spain. Nonetheless, it is hoped that this co-operation procedure facilitates and speeds up the authorisation process, while also providing greater legal certainty for companies that transfer personal data outside of the EEA.