Commission Decision
of 15 June 2001
on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC
(notified under document number C(2001) 1539)
(Text with EEA relevance)
(2001/497/EC)
THE COMMISSION OF THE EUROPEAN COMMUNITIES,
Having regard to the Treaty establishing the European Community,
Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(1), and in particular Article 26(4) thereof,
Whereas:
(1) Pursuant to Directive 95/46/EC, Member States are required to provide that a transfer of personal data to a third country may only take place if the third country in question ensures an adequate level of data protection and the Member States' laws, which comply with the other provisions of the Directive, are respected prior to the transfer.
(2) However, Article 26(2) of Directive 95/46/EC provides that Member States may authorise, subject to certain safeguards, a transfer or a set of transfers of personal data to third countries which do not ensure an adequate level of protection. Such safeguards may in particular result from appropriate contractual clauses.
(3) Pursuant to Directive 95/46/EC, the level of data protection should be assessed in the light of all the circumstances surrounding the data transfer operation or set of data transfer operations. The Working Party on Protection of Individuals with regard to the processing of personal data established under that Directive(2) has issued guidelines to aid with the assessment(3).
(4) Article 26(2) of Directive 95/46/EC, which provides flexibility for an organisation wishing to transfer data to third countries, and Article 26(4), which provides for standard contractual clauses, are essential for maintaining the necessary flow of personal data between the Community and third countries without unnecessary burdens for economic operators. Those Articles are particularly important in view of the fact that the Commission is unlikely to adopt adequacy findings under Article 25(6) for more than a limited number of countries in the short or even medium term.
(5) The standard contractual clauses are only one of several possibilities under Directive 95/46/EC, together with Article 25 and Article 26(1) and (2), for lawfully transferring personal data to a third country. It will be easier for organisations to transfer personal data to third countries by incorporating the standard contractual clauses in a contract. The standard contractual clauses relate only to data protection. The data exporter and the data importer are free to include any other clauses on business related issues, such as clauses on mutual assistance in cases of disputes with a data subject or a supervisory authority, which they consider as being pertinent for the contract as long as they do not contradict the standard contractual clauses.
(6) This Decision should be without prejudice to national authorisations Member States may grant in accordance with national provisions implementing Article 26(2) of Directive 95/46/EC. The circumstances of specific transfers may require that data controllers provide different safeguards within the meaning of Article 26(2). In any case, this Decision only has the effect of requiring the Member States not to refuse to recognise as providing adequate safeguards the contractual clauses described in it and does not therefore have any effect on other contractual clauses.
(7) The scope of this Decision is limited to establishing that the clauses in the Annex may be used by a controller established in the Community in order to adduce sufficient safeguards within the meaning of Article 26(2) of Directive 95/46/EC. The transfer of personal data to third countries is a processing operation in a Member State, the lawfulness of which is subject to national law. The data protection supervisory authorities of the Member States, in the exercise of their functions and powers under Article 28 of Directive 95/46/EC, should remain competent to assess whether the data exporter has complied with national legislation implementing the provisions of Directive 95/46/EC and, in particular, any specific rules as regards the obligation of providing information under that Directive.
(8) This Decision does not cover the transfer of personal data by controllers established in the Community to recipients established outside the territory of the Community who act only as processors. Those transfers do not require the same safeguards because the processor acts exclusively on behalf of the controller. The Commission intends to address that type of transfer in a subsequent decision.
(9) It is appropriate to lay down the minimum information that the parties must specify in the contract dealing with the transfer. Member States should retain the power to particularise the information the parties are required to provide. The operation of this Decision should be reviewed in the light of experience.
(10) The Commission will also consider in the future whether standard contractual clauses submitted by business organisations or other interested parties offer adequate safeguards in accordance with Directive 95/46/EC.
(11) While the parties should be free to agree on the substantive data protection rules to be complied with by the data importer, there are certain data protection principles which should apply in any event.
(12) Data should be processed and subsequently used or further communicated only for specified purposes and should not be kept longer than necessary.
(13) In accordance with Article 12 of Directive 95/46/EC, the data subject should have the right of access to all data relating to him and as appropriate to rectification, erasure or blocking of certain data.
(14) Further transfers of personal data to another controller established in a third country should be permitted only subject to certain conditions, in particular to ensure that data subjects are given proper information and have the opportunity to object, or in certain cases to withold their consent.
(15) In addition to assessing whether transfers to third countries are in accordance with national law, supervisory authorities should play a key role in this contractual mechanism in ensuring that personal data are adequately protected after the transfer. In specific circumstances, the supervisory authorities of the Member States should retain the power to prohibit or suspend a data transfer or a set of transfers based on the standard contractual clauses in those exceptional cases where it is established that a transfer on contractual basis is likely to have a substantial adverse effect on the guarantees providing adequate protection to the data subject.
(16) The standard contractual clauses should be enforceable not only by the organisations which are parties to the contract, but also by the data subjects, in particular, where the data subjects suffer damage as a consequence of a breach of the contract.
(17) The governing law of the contract should be the law of the Member State in which the data exporter is established, enabling a third-party beneficiary to enforce a contract. Data subjects should be allowed to be represented by associations or other bodies if they so wish and if authorised by national law.
(18) To reduce practical difficulties which data subjects could experience when trying to enforce their rights under the standard contractual clauses, the data exporter and the data importer should be jointly and severally liable for damages resulting from any violation of those provisions which are covered by the third-party beneficiary clause.
(19) The Data Subject is entitled to take action and receive compensation from the Data Exporter, the Data Importer or from both for any damage resulting from any act incompatible with the obligations contained in the standard contractual clauses. Both parties may be exempted from that liability if they prove that neither of them was responsible.
(20) Joint and several liability does not extend to those provisions not covered by the third-party beneficiary clause and does not need to leave one party paying for the damage resulting from the unlawful processing of the other party. Although mutual indemnification between the parties is not a requirement for the adequacy of the protection for the data subjects and may therefore be deleted, it is included in the standard contractual clauses for the sake of clarification and to avoid the need for the parties to negotiate indemnification clauses individually.
(21) In the event of a dispute between the parties and the data subject which is not amicably resolved and where the data subject invokes the third-party beneficiary clause, the parties agree to provide the data subject with the choice between mediation, arbitration or litigation. The extent to which the data subject will have an effective choice will depend on the availability of reliable and recognised systems of mediation and arbitration. Mediation by the supervisory authorities of a Member State should be an option where they provide such a service.
(22) The Working Party on the protection of individuals with regard to the processing of personal data established under Article 29 of Directive 95/46/EC has delivered an opinion on the level of protection provided under the standard contractual clauses annexed to this Decision, which has been taken into account in the preparation of this Decision(4).
(23) The measures provided for in this Decision are in accordance with the opinion of the Committee established under Article 31 of Directive 95/46/EC,
HAS ADOPTED THIS DECISION:
Article 1
The standard contractual clauses set out in the Annex are considered as offering adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights as required by Article 26(2) of Directive 9/46/EC.
Article 2
This Decision concerns only the adequacy of protection provided by the standard contractual clauses for the transfer of personal data set out in the Annex. It does not affect the application of other national provisions implementing Directive 95/46/EC that pertain to the processing of personal data within the Member States.
This Decision shall not apply to the transfer of personal data by controllers established in the Community to recipients established outside the territory of the Community who act only as processors.
Article 3
For the purposes of this Decision:
(a) the definitions in Directive 95/46/EC shall apply;
(b) "special categories of data" means the data referred to in Article 8 of that Directive;
(c) "supervisory authority" means the authority referred to in Article 28 of that Directive;
(d) "data exporter" means the controller who transfers the personal data;
(e) "data importer" means the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of this Decision.
Article 4
1. Without prejudice to their powers to take action to ensure compliance with national provisions adopted pursuant to chapters II, III, V and VI of Directive 95/46/EC, the competent authorities in the Member States may exercise their existing powers to prohibit or suspend data flows to third countries in order to protect individuals with regard to the processing of their personal data in cases where:
(a) it is established that the law to which the data importer is subject imposes upon him requirements to derogate from the relevant data protection rules which go beyond the restrictions necessary in a democratic society as provided for in Article 13 of Directive 95/46/EC where those requirements are likely to have a substantial adverse effect on the guarantees provided by the standard contractual clauses; or
(b) a competent authority has established that the data importer has not respected the contractual clauses; or
(c) there is a substantial likelihood that the standard contractual clauses in the Annex are not being or will not be complied with and the continuation of transfer would create an imminent risk of grave harm to the data subjects.
2. The prohibition or suspension pursuant to paragraph 1 shall be lifted as soon as the reasons for the prohibition or suspension no longer exist.
3. When Member States adopt measures pursuant to paragraphs 1 and 2, they shall without delay inform the Commission which will forward the information to the other Member States.
Article 5
The Commission shall evaluate the operation of this Decision on the basis of available information three years after its notification to the Member States. It shall submit a report on the endings to the Committee established under Article 31 of Directive 95/46/EC. It shall include any evidence that could affect the evaluation concerning the adequacy of the standard contractual clauses in the Annex and any evidence that this Decision is being applied in a discriminatory way.
Article 6
This Decision shall apply from 3 September 2001.
Article 7
This Decision is addressed to the Member States.
Done at Brussels, 15 June 2001.