# Presentation: 177392

## The Use of Contracts and BCRs to Transfer Personal Data 

**The European Union – United States Safe Harbor framework:**
**bringing differences in approaches to data protection**
**Washington, 7 December 2005**
***Agustín Puente Escobar – Head of the Legal Department***
***Agencia Española de Protección de Datos***

## 1. Introductory

## How to transfer data from the EU to the US

**Options**
**Safe ****Harbor **
**Cases under art. 26 (1) EU Directive**
**Contracts with model clause**
**Binding Corporate Rules**

## In order to facilitate data flows from the Community, it is desirable for data controllers to be able to perform data transfers globally under a single set of data protection rules. In the absence of global data protection standards, standard contractual clauses provide an important tool allowing the transfer of personal data from all Member States under a common set of rules 

Commission Decision 2004/915/EC. Preamble

***Commission Decision 2004/915/EC. Preamble***

## Requirements under Spanish Data Protection Act

**Proposed**** TDF**

**Company included in SH list**
**Art. 26 (1) EU Directive**

**Notification**** ****to ****AEPD’s **
**Register**

**If not: provide adequate**
**Safeguards:**
**Contractual clauses**
**Binding corporate rules**

**Authorisation of the **
**Director  of AEPD **

**Inscription of the TDF **
**in the AEPD’s Register**

## 2. Contractual clauses

## Possible options for contractual clauses

**TDF from controller to controller**
**Commission Decision 2001/497/EC**
**Commission Decision 2004/915/EC**
**TDF from controller to processor**
**Commission decision 2002/16/EC**
**Moreover**
**Other contracts that provide adequate safeguards according internal law**

## Since the use of standard contractual clauses for international data transfers is voluntary as standard contractual clauses are only one of several possibilities under Directive 95/46/EC, for lawfully transferring personal data to a third country, data exporters in the Community and data importers in third countries should be free to choose any of the sets of standard contractual clauses, or to choose some other legal basis for data transfer. 
As each set as a whole forms a model, data exporters should not, however, be allowed to amend these sets or totally or partially merge them in any manner. 

Commission Decision 2004/915/EC. Preamble

**As each set as a whole forms a model, data exporters should not, however, be allowed to amend these sets or totally or partially merge them in any manner.**** **
***Commission Decision 2004/915/EC. Preamble***

## Applicable law to data processing by the importer

**Purpose: to provide adequate safeguards within the personal data flows between both parties.**
**Therefore: Contractual clauses must provide an “adequacy area” within these flows equivalent i.e. to the safe harbor. **
**Consequence:**
**Law applicable should be “adequate”**
**Country where the exporter is located**
**Core principles **
**Safe Harbor principles (if importer is establish in the US)**

## Core principles

**Purpose limitation. **
**Data quality and proportionality.**
**Transparency. **
**Security and confidentiality.**
**Rights of access, rectification, erasure and blocking of data.**
**Special categories of data (consent, specific security measures).**
**“****Opt out principle” when using the data for direct marketing purposes.**
**Automated individual decisions.**

***WP12 and Decisions on standard clauses***

## Basic content of contractual clauses

**Third party beneficiary clause**
- The data subject must be able to enforce the contract against both parties
**Liability**
- Joint and several, or
- Based on “culpa in eligendo” or “in vigilando”
**Restrictions to onward transfers**
- Unless adequacy or consent is found
**Security and audit**
- To ascertain compliance with the warranties and undertakings provided by the clauses
**Non-variation of the clauses**

***Under Decisions 2001/497 and 2004/915***

## 3. Binding Corporate Rules

## Legal Components  of BCR’s

_**Pre-approved as compliant**_** with law governing protection of personal data in participating EU jurisdictions**
- Subject to procedural requirements of participating member states; BCR’s do not replace notification requirements, WP 74, p. 15.

***WP 74, 03 June 2003***

_**Internally binding**_** and enforceable on all B.U.s **
- Binding between all business units
- Binding between _employer and employees_
- Binding on _sub-contractors_
_**Externally binding**_** and enforceable on all B.U.s**
- _Consent to jurisdiction_ of **DPA** *and* **courts** in country of headquarters or place of alleged infraction
- _Consent to burden of proof_ of compliance
- Guarantee of _corporate responsibility for damages_

## Legal components of the BCRs. 

**Data processing regulation should respect EU data protection principles**
*“**Compliance with national law is of course a condition sine qua non for any authorisation to be granted”.*
**Limitation to onward transfers outside the group**
*“**Transfers from members of the corporate group outside of the Community to companies outside the corporate group would be possible by subscribing the standard contractual clauses adopted by the European Commission”*
**Third party beneficiary rights**
*“ **The scope of the third party beneficiary rights should match at least the one granted by the Commission Decision 2001/497 in respect of both the data importer and the data exporter*

***WP74, 03 june 1998***

## Practical Components  of BCR’s

**Binding Corporate Rules must include (not exhaustive):**
- Process flows of information compliant with data protection safeguards
- Internal enforcement process, including:
**Self-audits, transparency of rules + means for data subjects to verify compliance, complaints handling process, sanctions**
- Mechanism for reporting changes
- Evidence of effective incorporation of both internal and external binding liability (such as contracts)

***WP 74, 03 June 1998 and WP 108, 14 April 2005***

**Notes:**
Changes to BCR’s must be communicated through the Lead DPA in a systematic manner consistent with the Coordinated Procedure.

## Coordinated Procedure for Establishing BCR’s

**Submit **_**Draft**_
- Binding
- Corporate
- Rules

**Review & Comment**
**by remaining**
- DPA’s

- Distribute to
**Participating** DPA’s
- With
**Recommendation**

**Submit **_**Final**_
- Binding
- Corporate
- Rules

**Review & Comment**
**by remaining**
- DPA’s

- Distribute to
**Participating** DPA’s
- With
**Recommendation**

**Propose**
**Lead DPA**
- Nat’l Data
- Protection
- Authority

**Review & **
**Comment by all**
- implicated
- DPA’s

- Distribute to
**Implicated** DPA’s
- With
**Recommendation**

**Corporate**
**Representative**

**Lead DPA**

**Implicated**
**DPA’s**

**1**

**2**

**3**

**Consensus**

**Consensus**

**Opt-out**

**Opt-out**

**Opt-out**

**Adoption by Remaining DPA’s**

***WP 107, 14 April 2005***

**4**

**Fulfilling**
**internal **
**requirements**

**Notes:**
Each DPA approves the BCR’s on the basis of its own authority and substantive national law.
While the procedure is “coordinated,” there is no requirement of mutual recognition.

In cases where a national DPA objects to the provisions of the BCR’s, it may opt out.  The company will then be subject to the national law and procedures currently in force.

## Determination of “Lead Authority”

_**Factors in DPA country selection:**_
**Group headquarters**
**Relative significance of presence (# employees) vis a vis affiliates in other countries**
**Where responsibility for data processing is situated, or where decisions regarding processing are taken**
**Where most data processing occurs**
**Country from which most data transfers occur**
**Final determination is prerogative of the implicated DPA’s, by consensus, to **_**deter forum shopping**_**.**

**Relative**
**Factor**
**Weight**

## Caveats to “Pre-Approval”

**“****However, additional requirements that may exist in each country, such as notification or administrative formalities may also have to be complied with.” **
**	****	****	****Working Paper 107, pg. 4, point 6.**

## Obstacle to BCR’s in Civil Code Systems

**In civil code systems, unilateral declarations are not legally binding.**
**Spain, Italy**
**I.e. Spanish Civil Code only considers the law and the contract as sources of legal liability****   **
_**Without**_** a legal recourse for citizens on the basis of **_**a binding contract**_**, the concept of **_**Binding Corporate Rules will not satisfy constitutional requirements**_** protecting the rights regarding personal  data.**
_**Alternatives**_**:**
**Include Binding Corporate Rules in negotiated agreement with the Works Council.**
**Result: **_**Contract**_** with workers’ representative**
**Expressly provide in legislation for Binding Corporate Rules as a grounds for civil action.**

## Impact of forthcoming regulation pursuant to LOPD

_**Proposed solution in Spain**_** :**
**The Spanish Draft Royal Decree which develops the provisions of the LOPD 99 accepts the use BCRs for international data transfers on the basis that they are adopted as a code of conduct and are legally binding for all of the company ́s international subsidiaries.**

## Additional Considerations from Spanish Perspective on BCR’s

_**Key Component**_**: A high level of cooperation between the company and the DPA.**
**AEPD considers application for approval of BCR’s as a commitment to work with the Agency in good faith to ensure protection of personal data.**
**** Approval of BCR’s can be revoked given reasonable indication of failure to comply. ******(LOPD Art. 37(f))***

**Notes:**
AEPD is pursuing the implementation of BCR’s because it is beneficial to the citizens when companies commit to a culture of data protection.

## International Data Transfers – Binding Corporate Rules

**AEPD is working with the Commission and other DPAs via the Article 29 Working Group to develop a regime that facilitates multinational compliance that is efficient and effective through Binding Corporate Rules.**

## Slide 23