2001D0497 — EN — 04.07.2001 — 000.001 — 1
This document is meant purely as a documentation tool and the institutions do not assume any liability for its contents
►B COMMISSION DECISION
of 15 June 2001
on standard contractual clauses for the transfer of personal data to third countries, under Directive
95/46/EC
(notified under document number C(2001) 1539)
(Text with EEA relevance)
(2001/497/EC)
(OJ L 181, 4.7.2001, p. 19)
Corrected by:
►C1Corrigendum, OJ L 253, 21.9.2001, p. 34 (2001/497/EC)
▼B
COMMISSION DECISION
of 15 June 2001
on standard contractual clauses for the transfer of personal data to
third countries, under Directive 95/46/EC
(notified under document number C(2001) 1539)
(Text with EEA relevance)
(2001/497/EC)
THE COMMISSION OF THE EUROPEAN COMMUNITIES,
Havingreg ard to the Treaty establishingthe European Community,
Havingreg ard to Directive 95/46/EC of the European Parliament and of
the Council of 24 October 1995 on the protection of individuals withregard to the processing of personal data and on the free movement of
such data(
1), and in particular Article 26(4) thereof,
Whereas:
(1)Pursuant to Directive 95/46/EC, Member States are required to
provide that a transfer of personal data to a third country mayonly take place if the third country in question ensures anadequate level of data protection and the Member States' laws,which comply with the other provisions of the Directive, are
respected prior to the transfer.
(2)However, Article 26(2) of Directive 95/46/EC provides that
Member States may authorise, subject to certain safeguards, atransfer or a set of transfers of personal data to third countrieswhich do not ensure an adequate level of protection. Suchsafeguards may in particular result from appropriate contractual
clauses.
(3)Pursuant to Directive 95/46/EC, the level of data protection
should be assessed in the light of all the circumstancessurroundingthe data transfer operation or set of data transferoperations. The WorkingParty on Protection of Individuals with
regard to the processing of personal data established under that
Directive(
2) has issued guidelines to aid with the assessment(3).
(4)Article 26(2) ofDirective 95/46/EC, which provides flexibility foran organisation wishing to transfer data to third countries, andArticle 26(4), which provides for standard contractual clauses, are
essential for maintainingthe necessary flow of personal data
between the Community and third countries without unnecessaryburdens for economic operators. Those Articles are particularlyimportant in view of the fact that the Commission is unlikely toadopt adequacy findings under Article 25(6) for more than a
limited number of countries in the short or even medium term.2001D0497 — EN — 04.07.2001 — 000.001 — 2
(1) OJ L 281, 23.11.1995, p. 31.
(2) The Internet address of the WorkingParty is:
http://www.europa.eu.intlcomm/internal_market/en/medial/dataprot/wpdocs/
index.htm.
(3) WP 4 (5020/97) ‘First orientations on transfers of personal data to third
countries workingdocument — possible ways forward in assessing
adequacy’, a discussion document adopted by the WorkingParty on 26
June 1997.
WP 7 (5057/97) ‘Judging industry self regulation: when does it make a
meaningful contribution to the level of data protection in a third country?’,
workingdocument: adopted by the WorkingParty on 14 January 1998.
WP9 (3005/98) ‘Preliminary viewsonthe useof contractual provisionsin the
context of transfers of personal data to third countries’, workingdocument:
adopted by the WorkingParty on 22 April 1998.WP 12: ‘Transfers of personal data to third countries: applyingArticles 25
and 26of the EUdata protection directive’, workingdocument adopted bythe
WorkingParty on 24 July 1998, available, in the web-workingdocument site
‘europa.eu.int/comm/internal_markt/en/media.dataprot/wpdocs/wp12/en’
hosted by the European Commission.
▼B
(5)The standard contractual clauses are only one of several
possibilities under Directive 95/46/EC, together with Article 25
and Article 26(1) and (2), for lawfully transferringpersonal datato a third country. It will be easier for organisations to transferpersonal data to third countries by incorporatingthe standardcontractual clauses in a contract. The standard contractual clausesrelate only to data protection. The data exporter and the data
importer are free to include any other clauses on business related
issues, such as clauses on mutual assistance in cases of disputeswith a data subject ora supervisoryauthority, which they consideras beingpertinent for the contract as longas they do notcontradict the standard contractual clauses.
(6)This Decision should be without prejudice to national authorisa-tions Member States may grant in accordance with national
provisions implementingArticle 26(2) of Directive 95/46/EC.
The circumstances of specific transfers may require that datacontrollers provide different safeguards within the meaning ofArticle 26(2). In any case, this Decision only has the effect ofrequiringthe Member States not to refuse to recog nise asprovidingadequate safeg uards the contractual clauses described
in it and does not therefore have any effect on other contractual
clauses.
(7)The scope of this Decision is limited to establishingthat theclauses in the Annex may be used by a controller established inthe Community in order to adduce sufficient safeguards within themeaningof Article 26(2) of Directive 95/46/EC. The transfer ofpersonal data to third countries is a processingoperation in aMember State, the lawfulness of which is subject to national law.
The data protection supervisory authorities of the Member States,
in the exercise of their functions and powers under Article 28 ofDirective 95/46/EC, should remain competent to assess whetherthe data exporter has complied with national legislationimplementingthe provisions of Directive 95/46/EC and, in
particular, any specific rules as regards the obligation of
providinginformation under that Directive.
(8)This Decision does not cover the transfer of personal data bycontrollers established in the Community to recipients establishedoutside the territory of the Community who act only asprocessors. Those transfers do not require the same safeguardsbecause the processor acts exclusively on behalf of the controller.The Commission intends to address that type of transfer in a
subsequent decision.
(9)It is appropriate to lay down the minimum information that theparties must specify in the contract dealingwith the transfer.
Member States should retain the power to particularise theinformation the parties are required to provide. The operation ofthis Decision should be reviewed in the light of experience.
(10)The Commission will also consider in the future whether standardcontractual clauses submitted by business organisations or otherinterested parties offer adequate safeguards in accordance with
Directive 95/46/EC.
(11)While the parties should be free to agree on the substantive dataprotection rules to be complied with by the data importer, there
are certain data protection principles which should apply in anyevent.
(12)Data should be processed and subsequently used or furthercommunicated only for specified purposes and should not be keptlonger than necessary.
(13)In accordance with Article 12 of Directive 95/46/EC, the datasubject should have the right of access to all data relating to himand as appropriate to rectification, erasure or blockingof certaindata.
(14)Further transfers of personal data to another controller establishedin a third country should be permitted only subject to certain2001D0497 — EN — 04.07.2001 — 000.001 — 3
▼B
conditions, in particular to ensure that data subjects are given
proper information and have the opportunity to object, or incertain cases to withold their consent.
(15)In addition to assessingwhether transfers to third countries are inaccordance with national law, supervisory authorities should playa key role in this contractual mechanism in ensuringthat personaldata are adequately protected after the transfer. In specificcircumstances, the supervisory authorities of the Member Statesshould retain the power to prohibit or suspend a data transfer or a
set of transfers based on the standard contractual clauses in those
exceptional cases where it is established that a transfer oncontractual basis is likely to have a substantial adverse effect onthe guarantees providing adequate protection to the data subject.
(16)The standard contractual clauses should be enforceable not onlyby the organisations which are parties to the contract, but also by
the data subjects, in particular, where the data subjects suffer
damage as a consequence of a breach of the contract.
(17)The governing law of the contract should be the law of theMember State in which the data exporter is established, enablinga third-party beneficiary to enforce a contract. Data subjectsshould be allowed to be represented by associations or other
bodies if they so wish and if authorised by national law.
(18)To reduce practical difficulties which data subjects could
experience when tryingto enforce their rig hts under the standardcontractual clauses, the data exporter and the data importer shouldbe jointly and severally liable for damages resulting from anyviolation of those provisions which are covered by the third-party
beneficiary clause.
(19)The Data Subject is entitled to take action and receive
compensation from the Data Exporter, the Data Importer orfrom both for any damage resulting from any act incompatiblewith the obligations contained in the standard contractual clauses.Both parties may be exempted from that liability if they provethat neither of them was responsible.
(20)Joint and several liability does not extend to those provisions notcovered by the third-party beneficiary clause and does not need toleave one party payingfor the damag e resultingfrom the unlawfulprocessingof the other party. Althoug h mutual indemnificationbetween the parties is not a requirement for the adequacy of theprotection for the data subjects and may therefore be deleted, it is
included in the standard contractual clauses for the sake of
clarification and to avoid the need for the parties to negotiateindemnification clauses individually.
(21)In the event of a dispute between the parties and the data subjectwhich is not amicably resolved and where the data subjectinvokes the third-party beneficiary clause, the parties agree to
provide the data subject with the choice between mediation,
arbitration or litigation. The extent to which the data subject willhave an effective choice will depend on the availability of reliableand recognised systems of mediation and arbitration. Mediationby the supervisory authorities of a Member State should be anoption where they provide such a service.
(22)The WorkingParty on the protection of individuals with reg ard tothe processingof personal data established under Article 29 ofDirective 95/46/EC has delivered an opinion on the level ofprotection provided under the standard contractual clausesannexed to this Decision, which has been taken into account inthe preparation of this Decision(
1).2001D0497 — EN — 04.07.2001 — 000.001 — 4
(1) Opinion No 1/2001 adopted by the WorkingParty on 26 January 2001 (DG
MARKT 5102/00 WP 38), available in the website ‘Europa’ hosted by the
European Commission.
▼B
(23)The measures provided for in this Decision are in accordance with
the opinion of the Committee established under Article 31 of
Directive 95/46/EC,
HAS ADOPTED THIS DECISION:
Article 1
The standard contractual clauses set out in the Annex are considered as
offeringadequate safeg uards with respect to the protection of the
privacy and fundamental rights and freedoms of individuals and asregards the exercise of the corresponding rights as required by Article26(2) of Directive 9/46/EC.
Article 2
This Decision concerns only the adequacy of protection provided by the
standard contractual clauses for the transfer of personal data set out inthe Annex. It does not affect the application of other national provisions
implementingDirective 95/46/EC that pertain to the processingof
personal data within the Member States.
This Decision shall not apply to the transfer of personal data by
controllers established in the Community to recipients established
outside the territory of the Community who act only as processors.
Article 3
For the purposes of this Decision:
(a) the definitions in Directive 95/46/EC shall apply;
(b) ‘special categories of data’ means the data referred to in Article 8 of
that Directive;
(c) ‘supervisory authority’ means the authority referred to in Article 28
of that Directive;
(d) ‘data exporter’ means the controller who transfers the personal data;
(e) ‘data importer’ means the controller who agrees to receive from the
data exporter personal data for further processingin accordance withthe terms of this Decision.
Article 4
1. Without prejudice to their powers to take action to ensure
compliance with national provisions adopted pursuant to chapters II,
III, V and VI of Directive 95/46/EC, the competent authorities in the
Member States may exercise their existingpowers to prohibit or suspenddata flowsto third countries in order to protect individuals with regard tothe processingof their personal data in cases where:
(a) it is established that the law to which the data importer is subject
imposes upon him requirements to derogate from the relevant dataprotection rules which go beyond the restrictions necessary in ademocratic society as provided for in Article 13 of Directive 95/46/EC where those requirements are likely to have a substantial adverse
effect on the guarantees provided by the standard contractual
clauses; or
(b) a competent authority has established that the data importer has not
respected the contractual clauses; or
(c) there is a substantial likelihood that the standard contractual clauses
in the Annex are not beingor will not be complied with and thecontinuation of transfer would create an imminent risk of graveharm to the data subjects.
2. The prohibition or suspension pursuant to paragraph 1 shall be
lifted as soon as the reasons for the prohibition or suspension no longerexist.2001D0497 — EN — 04.07.2001 — 000.001 — 5
▼B
3. When Member States adopt measures pursuant to paragraphs 1 and
2, they shall without delay inform the Commission which will forwardthe information to the other Member States.
Article 5
The Commission shall evaluate the operation of this Decision on the
basis of available information three years after its notification to the
Member States. It shall submit a report on the endings to the Committeeestablished under Article 31 of Directive 95/46/EC. It shall include anyevidence that could affect the evaluation concerningthe adequacy of thestandard contractual clauses in the Annex and any evidence that thisDecision is beingapplied in a discriminatory way.
Article 6
This Decision shall apply from 3 September 2001.
Article 7
This Decision is addressed to the Member States.2001D0497 — EN — 04.07.2001 — 000.001 — 6
▼B
ANNEX
2001D0497 — EN — 04.07.2001 — 000.001 — 7
▼B
2001D0497 — EN — 04.07.2001 — 000.001 — 8
▼B
►(1)C12001D0497 — EN — 04.07.2001 — 000.001 — 9
▼B
2001D0497 — EN — 04.07.2001 — 000.001 — 10
▼B
Appendix 1
to the standard contractual clauses
2001D0497 — EN — 04.07.2001 — 000.001 — 11
▼B
2001D0497 — EN — 04.07.2001 — 000.001 — 12
▼B
Appendix 2
to the standard contractual clauses
Mandatory data protection principles referred to in the first paragraph of
Clause 5(b)
These data protection principles should be read and interpreted in the light of the
provisions (principles and relevant exceptions) of Directive 95/46/EC.
They shall apply subject to the mandatory requirements of the national legislation
applicable to the data importer which do not go beyond what is necessary in a
democratic society on the basis of one of the interests listed in Article 13(1) of
Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard
national security, defence, public security, the prevention, investigation, detection
and prosecution of criminal offences or of breaches of ethics for the regulated
professions, an important economic or financial interest of the State or the
protection of the data subject or the rights and freedoms of others.
1.Purpose limitation : data must be processed and subsequently used or further
communicated only for the specific purposes in Appendix I to the Clauses.
Data must not be kept longer than necessary for the purposes for which they
are transferred.
2.Dataqualityandproportionality : data must be accurate and, where necessary,
kept up to date. The data must be adequate, relevant and not excessive in
relation to the purposes for which they are transferred and further processed.
3.Transparency : data subjects must be provided with information as to the
purposes of the processingand the identity of the data controller in the third
country, and other information insofar as this is necessary to ensure fair
processing, unless such information has already been given by the data
exporter.
4.Security and confidentiality : technical and organisational security measures
must be taken by the data controller that are appropriate to the risks, such as
unauthorised access, presented by the processing. Any person acting under the
authority of the data controller, includinga processor, must not process the
data except on instructions from the controller.
5.Rightsofaccess,rectification,erasureandblockingofdata : as provided for in
Article 12 of Directive 95/46/EC, the data subject must have a right of access
to all data relatingto him that are processed and, as appropriate, the rig ht to
the rectification, erasure or blockingof data the processingof which does not
comply with the principles set out in this Appendix, in particular because the
data are incomplete or inaccurate. He should also be able to object to the
processing of the data relating to him on compelling legitimate grounds
relatingto his particular situation.
6.Restrictions on onwards transfers : further transfers of personal data from the
data importer to another controller established in a third country not providing
adequate protection or not covered by a decision adopted by the Commission
pursuant to Article 25(6) of Directive 95/46/EC (onward transfer) may take
place only if either:
(a) data subjects have, in the case of special categories of data, given their
unambiguous consent to the onward transfer or, in other cases, have been
given the opportunity to object.
The minimum information to be provided to data subjects must contain in
a language understandable to them:
— the purposes of the onward transfer,
— the identification of the data exporter established in the Community,
— the categories of further recipients of the data and the countries of
destination, and
— an explanation that, after the onward transfer, the data may be
processed by a controller established in a country where there is not an
adequate level of protection of the privacy of individuals; or
(b) the data exporter and the data importer agree to the adherence to the
Clauses of another controller which thereby becomes a party to the
Clauses and assumes the same obligations as the data importer.
7.Special categories of data : where data revealingracial or ehtnic orig in,
political opinions, religious or philosophical beliefs or trade union member-
ships and data concerninghealth or sex life and data relatingto offences,
criminal convictions or security measures are processed, additional safeguards
should be in place within the meaningof Directive 95/46/EC, in particular,2001D0497 — EN — 04.07.2001 — 000.001 — 13
▼B
appropriate security measures such as strongencryption for transmission or
such as keepinga record of access to sensitive data.
8.Direct marketing : where data are processed for the purposes of direct
marketing, effective procedures should exist allowing the data subject at any
time to ‘opt-out’ from havinghis data used for such purposes.
9.Automatedindividualdecisions : data subjects are entitled not to be subject to a
decision which is based soley on automated processingof data, unless other
measures are taken to safeguard the individual's legitimate interests as
provided for in Article 15(2) of Directive 95/46/EC. Where the purpose of the
transfer is the takingof an automated decision as referred to in Article 15 of
Directive 95/46/EC, which produces legal effects concerning the individual or
significantly affects him and which is based solely on automated processing of
data intended to evaluate certain personal aspects relatingto him, such as his
performance at work, creditworthiness, reliability, conduct, etc., the individual
should have the right to know the reasoning for this decision.2001D0497 — EN — 04.07.2001 — 000.001 — 14
▼B
Appendix 3
to the standard contractual clauses
Mandatory data protection principles referred to in the second paragraph of
Clause 5(b)
1.Purpose limitation : data must be processed and subsequently used or further
communicated only for the specific purposes in Appendix I to the Clauses.
Data must not be kept longer than necessary for the purposes for which they
are transferred.
2.Rightsofaccess,rectification,erasureandblockingofdata : as provided for in
Article 12 of Directive 95/46/EC, the data subject must have a right of access
to all data relatingto him that are processed and, as appropriate, the rig ht to
the rectification, erasure or blockingof data the processingof which does not
comply with the principles set out in this Appendix, in particular because the
data is incomplete or inaccurate. He should also be able to object to the
processing of the data relating to him on compelling legitimate grounds
relatingto his particular situation.
3.Restrictions on onward transfers : further transfers of personal data from the
data importer to another controller established in a third country not providing
adequate protection or not covered by a decision adopted by the Commission
pursuant to Article 25(6) of Directive 95/46/EC (onward transfer) may take
place only if either:
(a) data subjects have, in the case of special categories of data, given their
unambiguous consent to the onward transfer, or, in other cases, have been
given the opportunity to object.
The minimum information to be provided to data subjects must contain in
a language understandable to them:
— the purposes of the onward transfer,
— the identification of the data exporter established in the Community,— the categories of further recipients of the data and the countries of
destination, and
— an explanation that, after the onward transfer, the data may be
processed by a controller established in a country where there is not an
adequate level of protection of the privacy of indidividuals; or
(b) the data exporter and the data importer agree to the adherence to the
Clauses of another controller which thereby becomes a party to the
Clauses and assumes the same obligations as the data importer.2001D0497 — EN — 04.07.2001 — 000.001 — 15