Standard Clauses For Data Transfers To Non-EU Countries Approved

by Ulrika Lomas, for LawAndTax-News.com, Brussels

11 January 2005

The European Commission last week announced that it has approved a new set of standard contractual clauses which businesses can use to ensure adequate safeguards when personal data is transferred from the EU to non-EU countries.

The new clauses, submitted by a business coalition led by the International Chamber of Commerce, will be added to those already available under the Commission’s June 2001 decision. Use of standard contractual clauses offers companies and other organisations a straightforward means of complying with their obligation, under the 1995 EU Data Protection Directive, to ensure "adequate protection" for personal data transferred outside the EU.

Single Market Commissioner Charlie McCreevy, observed that:

"”This is a good example of regulating in cooperation with business. The business community has shown a serious commitment towards data protection and the Commission has carefully listened to business needs. That is good for EU citizens, whose privacy is better protected, and for our companies, whose competitiveness is reinforced.”

Although some of the new clauses, such as those on litigation, allocation of responsibilities or auditing requirements, have been designed to be more business-friendly, they provide for a similar level of data protection as those of 2001. In addition, to prevent abuses, data protection authorities have been given more powers to intervene and impose sanctions where necessary.

The Commission went on to add, however, that:

"Contractual clauses are not necessary to transfer data to Switzerland, Canada, Argentina and the UK territories of Guernsey and the Isle of Man, whose own regimes are recognised by the Commission as offering adequate data protection. Neither are they needed for transfers to US companies adhering to the 'Safe Harbor' Privacy Principles issued by the US Department of Commerce."

Recommended