2001/497/EC: Commission Decision of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC (Text with EEA relevance) (notified under document number C(2001) 1539)
Date: 2001-06-15
Institutions: European Commission
Subjects: contract terms, cross-frontier data flow, data protection, disclosure of information, personal data, protection of privacy

4.7.2001

EN

Official Journal of the European Communities

L 181/19

II

(Acts whose publication is not obligatory)

COMMISSION

COMMISSION DECISION

of 15 June 2001

on standard contractual clauses for the transfer of personal data to third countries, under Directive
95/46/EC

(notified under document number C(2001) 1539)

(Text with EEA relevance)

(2001/497/EC)

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995
on the protection of individuals with regard to the processing of personal data and on the free movement
of such data (1), and in particular Article 26(4) thereof,

Whereas:

(1)

(2)

(3)

Pursuant to Directive 95/46/EC, Member States are required to provide that a transfer of personal
data to a third country may only take place if the third country in question ensures an adequate level
of data protection and the Member States' laws, which comply with the other provisions of the
Directive, are respected prior to the transfer.

However, Article 26(2) of Directive 95/46/EC provides that Member States may authorise, subject to
certain safeguards, a transfer or a set of transfers of personal data to third countries which do not
ensure an adequate level of protection. Such safeguards may in particular result from appropriate
contractual clauses.

Pursuant to Directive 95/46/EC, the level of data protection should be assessed in the light of all the
circumstances surrounding the data transfer operation or set of data transfer operations. The
Working Party on Protection of Individuals with regard to the processing of personal data established
under that Directive (2) has issued guidelines to aid with the assessment (3).

(1) OJ L 281, 23.11.1995, p. 31.
(2) The Internet address of the Working Party is:

http://www.europa.eu.intlcomm/internal_market/en/medial/dataprot/wpdocs/index.htm.

(3) WP 4 (5020/97)

‘First orientations on transfers of personal data to third countries working document — possible

ways forward in assessing adequacy’, a discussion document adopted by the Working Party on 26 June 1997.
WP 7 (5057/97) ‘Judging industry self regulation: when does it make a meaningful contribution to the level of data
protection in a third country?’, working document: adopted by the Working Party on 14 January 1998.
WP 9 (3005/98) ‘Preliminary views on the use of contractual provisions in the context of transfers of personal data
to third countries’, working document: adopted by the Working Party on 22 April 1998.
the EU data protection
WP 12:
‘Transfers of personal data to third countries: applying Articles 25 and 26 of
directive’, working document adopted by the Working Party on 24 July 1998, available,
in the web-working docu-
ment site ‘europa.eu.int/comm/internal_markt/en/media.dataprot/wpdocs/wp12/en’ hosted by the European Commis-
sion.

L 181/20

EN

Official Journal of the European Communities

4.7.2001

(4)

(5)

(6)

(7)

(8)

(9)

Article 26(2) of Directive 95/46/EC, which provides flexibility for an organisation wishing to transfer
data to third countries, and Article 26(4), which provides for standard contractual clauses, are
essential for maintaining the necessary flow of personal data between the Community and third
countries without unnecessary burdens for economic operators. Those Articles are particularly
important in view of the fact that the Commission is unlikely to adopt adequacy findings under
Article 25(6) for more than a limited number of countries in the short or even medium term.

The standard contractual clauses are only one of several possibilities under Directive 95/46/EC,
together with Article 25 and Article 26(1) and (2), for lawfully transferring personal data to a third
country. It will be easier for organisations to transfer personal data to third countries by incorpor-
ating the standard contractual clauses in a contract. The standard contractual clauses relate only to
data protection. The data exporter and the data importer are free to include any other clauses on
business related issues, such as clauses on mutual assistance in cases of disputes with a data subject
or a supervisory authority, which they consider as being pertinent for the contract as long as they do
not contradict the standard contractual clauses.

This Decision should be without prejudice to national authorisations Member States may grant in
accordance with national provisions implementing Article 26(2) of Directive 95/46/EC. The circum-
stances of specific transfers may require that data controllers provide different safeguards within the
meaning of Article 26(2). In any case, this Decision only has the effect of requiring the Member
States not to refuse to recognise as providing adequate safeguards the contractual clauses described
in it and does not therefore have any effect on other contractual clauses.

The scope of this Decision is limited to establishing that the clauses in the Annex may be used by a
controller established in the Community in order to adduce sufficient safeguards within the meaning
of Article 26(2) of Directive 95/46/EC. The transfer of personal data to third countries is a
processing operation in a Member State, the lawfulness of which is subject to national law. The data
protection supervisory authorities of the Member States,
in the exercise of their functions and
powers under Article 28 of Directive 95/46/EC, should remain competent to assess whether the data
exporter has complied with national legislation implementing the provisions of Directive 95/46/EC
and, in particular, any specific rules as regards the obligation of providing information under that
Directive.

This Decision does not cover the transfer of personal data by controllers established in the
Community to recipients established outside the territory of the Community who act only as
processors. Those transfers do not require the same safeguards because the processor acts exclusively
on behalf of the controller. The Commission intends to address that type of transfer in a subsequent
decision.

It is appropriate to lay down the minimum information that the parties must specify in the contract
dealing with the transfer. Member States should retain the power to particularise the information the
parties are required to provide. The operation of this Decision should be reviewed in the light of
experience.

(10)

The Commission will also consider in the future whether standard contractual clauses submitted by
business organisations or other interested parties offer adequate safeguards in accordance with
Directive 95/46/EC.

(11) While the parties should be free to agree on the substantive data protection rules to be complied
with by the data importer, there are certain data protection principles which should apply in any
event.

(12) Data should be processed and subsequently used or further communicated only for specified

purposes and should not be kept longer than necessary.

(13)

In accordance with Article 12 of Directive 95/46/EC, the data subject should have the right of access
to all data relating to him and as appropriate to rectification, erasure or blocking of certain data.

4.7.2001

EN

Official Journal of the European Communities

L 181/21

(14)

(15)

(16)

(17)

(18)

(19)

(20)

(21)

Further transfers of personal data to another controller established in a third country should be
permitted only subject to certain conditions, in particular to ensure that data subjects are given
proper information and have the opportunity to object, or in certain cases to withold their consent.

In addition to assessing whether transfers to third countries are in accordance with national law,
supervisory authorities should play a key role in this contractual mechanism in ensuring that
personal data are adequately protected after the transfer. In specific circumstances, the supervisory
authorities of the Member States should retain the power to prohibit or suspend a data transfer or a
set of transfers based on the standard contractual clauses in those exceptional cases where it is
established that a transfer on contractual basis is likely to have a substantial adverse effect on the
guarantees providing adequate protection to the data subject.

The standard contractual clauses should be enforceable not only by the organisations which are
parties to the contract, but also by the data subjects, in particular, where the data subjects suffer
damage as a consequence of a breach of the contract.

The governing law of the contract should be the law of the Member State in which the data exporter
is established, enabling a third-party beneficiary to enforce a contract. Data subjects should be
allowed to be represented by associations or other bodies if they so wish and if authorised by
national

law.

To reduce practical difficulties which data subjects could experience when trying to enforce their
rights under the standard contractual clauses, the data exporter and the data importer should be
jointly and severally liable for damages resulting from any violation of those provisions which are
covered by the third-party beneficiary clause.

The Data Subject is entitled to take action and receive compensation from the Data Exporter, the
Data Importer or from both for any damage resulting from any act incompatible with the obliga-
tions contained in the standard contractual clauses. Both parties may be exempted from that liability
if they prove that neither of them was responsible.

Joint and several
liability does not extend to those provisions not covered by the third-party
beneficiary clause and does not need to leave one party paying for the damage resulting from the
unlawful processing of the other party. Although mutual indemnification between the parties is not a
requirement for the adequacy of the protection for the data subjects and may therefore be deleted, it
is included in the standard contractual clauses for the sake of clarification and to avoid the need for
the parties to negotiate indemnification clauses individually.

In the event of a dispute between the parties and the data subject which is not amicably resolved and
where the data subject invokes the third-party beneficiary clause, the parties agree to provide the data
subject with the choice between mediation, arbitration or litigation. The extent to which the data
subject will have an effective choice will depend on the availability of reliable and recognised systems
of mediation and arbitration. Mediation by the supervisory authorities of a Member State should be
an option where they provide such a service.

(22)

The Working Party on the protection of individuals with regard to the processing of personal data
established under Article 29 of Directive 95/46/EC has delivered an opinion on the level of
protection provided under the standard contractual clauses annexed to this Decision, which has been
taken into account in the preparation of this Decision (1).

(23)

The measures provided for in this Decision are in accordance with the opinion of the Committee
established under Article 31 of Directive 95/46/EC,

(1) Opinion No 1/2001 adopted by the Working Party on 26 January 2001 (DG MARKT 5102/00 WP 38), available in

the website ‘Europa’ hosted by the European Commission.

L 181/22

EN

Official Journal of the European Communities

4.7.2001

HAS ADOPTED THIS DECISION:

Article 1

The standard contractual clauses set out in the Annex are considered as offering adequate safeguards with
respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards
the exercise of the corresponding rights as required by Article 26(2) of Directive 9/46/EC.

Article 2

This Decision concerns only the adequacy of protection provided by the standard contractual clauses for
the transfer of personal data set out in the Annex. It does not affect the application of other national
provisions implementing Directive 95/46/EC that pertain to the processing of personal data within the
Member States.

This Decision shall not apply to the transfer of personal data by controllers established in the Community
to recipients established outside the territory of the Community who act only as processors.

Article 3

For the purposes of this Decision:

(a) the definitions in Directive 95/46/EC shall apply;

(b) ‘special categories of data’ means the data referred to in Article 8 of that Directive;

(c) ‘supervisory authority’ means the authority referred to in Article 28 of that Directive;

(d) ‘data exporter’ means the controller who transfers the personal data;

(e) ‘data importer’ means the controller who agrees to receive from the data exporter personal data for

further processing in accordance with the terms of this Decision.

Article 4

1. Without prejudice to their powers to take action to ensure compliance with national provisions
adopted pursuant to chapters II, III, V and VI of Directive 95/46/EC, the competent authorities in the
Member States may exercise their existing powers to prohibit or suspend data flows to third countries in
order to protect individuals with regard to the processing of their personal data in cases where:

(a) it is established that the law to which the data importer is subject imposes upon him requirements to
derogate from the relevant data protection rules which go beyond the restrictions necessary in a
democratic society as provided for in Article 13 of Directive 95/46/EC where those requirements are
likely to have a substantial adverse effect on the guarantees provided by the standard contractual
clauses; or

(b) a competent authority has established that the data importer has not respected the contractual clauses;

or

(c) there is a substantial likelihood that the standard contractual clauses in the Annex are not being or will
not be complied with and the continuation of transfer would create an imminent risk of grave harm to
the data subjects.

The prohibition or suspension pursuant to paragraph 1 shall be lifted as soon as the reasons for the

2.
prohibition or suspension no longer exist.

3. When Member States adopt measures pursuant to paragraphs 1 and 2, they shall without delay
inform the Commission which will forward the information to the other Member States.

4.7.2001

EN

Official Journal of the European Communities

L 181/23

Article 5

The Commission shall evaluate the operation of this Decision on the basis of available information three
years after its notification to the Member States. It shall submit a report on the endings to the Committee
established under Article 31 of Directive 95/46/EC. It shall include any evidence that could affect the
evaluation concerning the adequacy of the standard contractual clauses in the Annex and any evidence that
this Decision is being applied in a discriminatory way.

This Decision shall apply from 3 September 2001.

Article 6

This Decision is addressed to the Member States.

Article 7

Done at Brussels, 15 June 2001.

For the Commission

Frederik BOLKESTEIN

Member of the Commission

L 181/24

EN

Official Journal of the European Communities

4.7.2001

ANNEX

4.7.2001

EN

Official Journal of the European Communities

L 181/25

L 181/26

EN

Official Journal of the European Communities

4.7.2001

4.7.2001

EN

Official Journal of the European Communities

L 181/27

L 181/28

EN

Official Journal of the European Communities

4.7.2001

Appendix 1

to the standard contractual clauses

4.7.2001

EN

Official Journal of the European Communities

L 181/29

L 181/30

EN

Official Journal of the European Communities

4.7.2001

Appendix 2

to the standard contractual clauses

Mandatory data protection principles referred to in the first paragraph of Clause 5(b)

These data protection principles should be read and interpreted in the light of the provisions (principles and relevant
exceptions) of Directive 95/46/EC.

They shall apply subject to the mandatory requirements of the national legislation applicable to the data importer which
do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of
Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defence, public security,
the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated
professions, an important economic or financial interest of the State or the protection of the data subject or the rights and
freedoms of others.

1. Purpose limitation: data must be processed and subsequently used or further communicated only for the specific
purposes in Appendix I to the Clauses. Data must not be kept longer than necessary for the purposes for which they
are transferred.

2. Data quality and proportionality: data must be accurate and, where necessary, kept up to date. The data must be
adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.

3. Transparency: data subjects must be provided with information as to the purposes of the processing and the identity of
the data controller in the third country, and other information insofar as this is necessary to ensure fair processing,
unless such information has already been given by the data exporter.

4. Security and confidentiality: technical and organisational security measures must be taken by the data controller that are
appropriate to the risks, such as unauthorised access, presented by the processing. Any person acting under the
authority of the data controller, including a processor, must not process the data except on instructions from the
controller.

5. Rights of access, rectification, erasure and blocking of data: as provided for in Article 12 of Directive 95/46/EC, the data
subject must have a right of access to all data relating to him that are processed and, as appropriate, the right to the
rectification, erasure or blocking of data the processing of which does not comply with the principles set out in this
Appendix,
in particular because the data are incomplete or inaccurate. He should also be able to object to the
processing of the data relating to him on compelling legitimate grounds relating to his particular situation.

6. Restrictions on onwards transfers: further transfers of personal data from the data importer to another controller
established in a third country not providing adequate protection or not covered by a decision adopted by the
Commission pursuant to Article 25(6) of Directive 95/46/EC (onward transfer) may take place only if either:

(a) data subjects have, in the case of special categories of data, given their unambiguous consent to the onward

transfer or,

in other cases, have been given the opportunity to object.

The minimum information to be provided to data subjects must contain in a language understandable to them:

— the purposes of the onward transfer,

— the identification of the data exporter established in the Community,

— the categories of further recipients of the data and the countries of destination, and

— an explanation that, after the onward transfer, the data may be processed by a controller established in a

country where there is not an adequate level of protection of the privacy of individuals; or

(b) the data exporter and the data importer agree to the adherence to the Clauses of another controller which thereby

becomes a party to the Clauses and assumes the same obligations as the data importer.

7. Special categories of data: where data revealing racial or ehtnic origin, political opinions, religious or philosophical beliefs
or trade union memberships and data concerning health or sex life and data relating to offences, criminal convictions
or security measures are processed, additional safeguards should be in place within the meaning of Directive 95/46/EC,
in particular, appropriate security measures such as strong encryption for transmission or such as keeping a record of
access to sensitive data.

8. Direct marketing: where data are processed for the purposes of direct marketing, effective procedures should exist

allowing the data subject at any time to ‘opt-out’ from having his data used for such purposes.

4.7.2001

EN

Official Journal of the European Communities

L 181/31

9. Automated individual decisions: data subjects are entitled not to be subject to a decision which is based soley on
automated processing of data, unless other measures are taken to safeguard the individual's legitimate interests as
provided for in Article 15(2) of Directive 95/46/EC. Where the purpose of the transfer is the taking of an automated
decision as referred to in Article 15 of Directive 95/46/EC, which produces legal effects concerning the individual or
significantly affects him and which is based solely on automated processing of data intended to evaluate certain
personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc., the
individual should have the right to know the reasoning for this decision.

Appendix 3

to the standard contractual clauses

Mandatory data protection principles referred to in the second paragraph of Clause 5(b)

1. Purpose limitation: data must be processed and subsequently used or further communicated only for the specific
purposes in Appendix I to the Clauses. Data must not be kept longer than necessary for the purposes for which they
are transferred.

2. Rights of access, rectification, erasure and blocking of data: as provided for in Article 12 of Directive 95/46/EC, the data
subject must have a right of access to all data relating to him that are processed and, as appropriate, the right to the
rectification, erasure or blocking of data the processing of which does not comply with the principles set out in this
Appendix, in particular because the data is incomplete or inaccurate. He should also be able to object to the processing
of the data relating to him on compelling legitimate grounds relating to his particular situation.

3. Restrictions on onward transfers: further transfers of personal data from the data importer to another controller
established in a third country not providing adequate protection or not covered by a decision adopted by the
Commission pursuant to Article 25(6) of Directive 95/46/EC (onward transfer) may take place only if either:

(a) data subjects have, in the case of special categories of data, given their unambiguous consent to the onward

transfer, or,

in other cases, have been given the opportunity to object.

The minimum information to be provided to data subjects must contain in a language understandable to them:
— the purposes of the onward transfer,
— the identification of the data exporter established in the Community,
— the categories of further recipients of the data and the countries of destination, and
— an explanation that, after the onward transfer, the data may be processed by a controller established in a

country where there is not an adequate level of protection of the privacy of indidividuals; or

(b) the data exporter and the data importer agree to the adherence to the Clauses of another controller which thereby

becomes a party to the Clauses and assumes the same obligations as the data importer.