2002/16/EC: Commission Decision of 27 December 2001 on standard contractual clauses for the transfer of personal data to processors established in third countries, under Directive 95/46/EC (Text with EEA relevance) (notified under document number C(2001) 4540)
Date: 2001-12-27
Institutions: European Commission
Subjects: confidentiality, cross-frontier data flow, disclosure of information, personal data, protection of privacy, third country

L 6/52

EN

Official Journal of the European Communities

10.1.2002

II

(Acts whose publication is not obligatory)

COMMISSION

COMMISSION DECISION

of 27 December 2001

on standard contractual clauses for the transfer of personal data to processors established in third
countries, under Directive 95/46/EC

(notified under document number C(2001) 4540)

(Text with EEA relevance)

(2002/16/EC)

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European Community,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995
on the protection of individuals with regard to the processing of personal data and on the free movement
of such data (1), and in particular Article 26(4) thereof,

Whereas:

(1)

(2)

(3)

Pursuant to Directive 95/46/EC Member States are required to provide that a transfer of personal
data to a third country may only take place if the third country in question ensures an adequate level
of data protection and the Member States' laws, which comply with the other provisions of the
Directive, are respected prior to the transfer.

However, Article 26(2) of Directive 95/46/EC provides that Member States may authorise, subject to
certain safeguards, a transfer or a set of transfers of personal data to third countries which do not
ensure an adequate level of protection. Such safeguards may in particular result from appropriate
contractual clauses.

Pursuant to Directive 95/46/EC the level of data protection should be assessed in the light of all the
circumstances surrounding the data transfer operation or set of data transfer operations. The
Working Party on the Protection of Individuals with regard to the Processing of Personal Data
established under that Directive (2) has issued guidelines to aid with the assessment (3).

(1) OJ L 281, 23.11.1995, p. 31.
(2) The web address of the Working Party is:

http://europa.eu.int/comm/internal_market/en/dataprot/wpdocs/index.htm.

(3) WP 4 (5020/97):

‘First orientations on Transfers of Personal Data to Third Countries — Possible Ways Forward in

Assessing Adequacy’, a discussion document adopted by the Working Party on 26 June 1997.
WP 7 (5057/97): Working document:
to the level of data protection in a third country?’, adopted by the Working Party on 14 January 1998.
WP 9 (5005/98): Working Document:
transfers of personal data to third countries’, adopted by the Working Party on 22 April 1998.
WP 12: Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection direc-
tive, adopted by the Working Party on 24 July 1998, available on the website
‘http://europa.eu.int/comm/internal_market/en/dataprot/wpdocs/wp12en.htm’ hosted by the European Commission.

‘Judging industry self-regulation: when does it make a meaningful contribution

‘Preliminary views on the use of contractual provisions in the context of

10.1.2002

EN

Official Journal of the European Communities

L 6/53

(4)

(5)

(6)

(7)

(8)

(9)

The standard contractual clauses relate only to data protection. The data exporter and the data
importer are free to include any other clauses on business related issues which they consider as being
pertinent for the contract as long as they do not contradict the standard contractual clauses.

This Decision should be without prejudice to national authorisations Member States may grant in
accordance with national provisions implementing Article 26(2) of Directive 95/46/EC. This
Decision only has the effect of requiring the Member States not to refuse to recognise as providing
adequate safeguards the contractual clauses set out in it and does not therefore have any effect on
other contractual clauses.

The scope of this Decision is limited to establishing that the clauses which it sets out may be used by
a data controller established in the Community in order to adduce adequate safeguards within the
meaning of Article 26(2) of Directive 95/46/EC for the transfer of personal data to a processor
established in a third country.

This Decision should implement the obligation provided for in Article 17(3) of Directive 95/46/EC
and does not prejudice the content of the contracts or legal acts established pursuant to that
provision. However, some of the standard contractual clauses,
in particular as regards the data
exporter's obligations, should be included in order to increase clarity as to the provisions which may
be contained in a contract between a controller and a processor.

Supervisory authorities of the Member States play a key role in this contractual mechanism in
ensuring that personal data are adequately protected after the transfer. In exceptional cases where
data exporters refuse or are unable to instruct the data importer properly, with an imminent risk of
grave harm to the data subjects, the standard contractual clauses should allow the supervisory
authorities to audit data importers and, where appropriate, take decisions which are binding on data
importers. The supervisory authorities should have the power to prohibit or suspend a data transfer
or a set of transfers based on the standard contractual clauses in those exceptional cases where it is
established that a transfer on contractual basis is likely to have a substantial adverse effect on the
warranties and obligations providing adequate protection for the data subject.

The Commission may also consider in the future whether standard contractual clauses for the
transfer of personal data to data processors established in third countries not offering an adequate
level of data protection, submitted by business organisations or other interested parties, offer
adequate safeguards in accordance with Article 26(2) of Directive 95/46/EC.

(10) A disclosure of personal data to a data processor established outside the Community is an inter-
national transfer protected under Chapter IV of Directive 95/46/EC. Consequently, this Decision does
not cover the transfer of personal data by controllers established in the Community to controllers
established outside the Community who fall within the scope of Commission Decision 2001/497/EC
of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries,
under Directive 95/46/EC (1).

(11)

(12)

The standard contractual clauses should provide for the technical and organisational security
measures ensuring a level of security appropriate to the risks represented by the processing and the
nature of the data to be protected that a data processor established in a third country not providing
adequate protection must apply. Parties should make provision in the contract for those technical
and organisational measures which, having regard to applicable data protection law, the state of the
art and the cost of their implementation, are necessary in order to protect personal data against
accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access or
any other unlawful forms of processing.

In order to facilitate data flows from the Community, it is desirable that processors providing data
processing services to several data controllers in the Community be allowed to apply the same
technical and organisational security measures irrespective of the Member State from which the data
transfer originates, in particular in those cases where the data importer receives data for further
processing from different establishments of the data exporter in the Community, in which case the
law of the designated Member State of establishment should apply.

(1) OJ L 181, 4.7.2001, p. 19.

L 6/54

EN

Official Journal of the European Communities

10.1.2002

(13)

(14)

(15)

(16)

(17)

(18)

(19)

It is appropriate to lay down the minimum information that the parties must specify in the contract
dealing with the transfer. Member States should retain the power to particularise the information the
parties are required to provide. The operation of this Decision should be reviewed in the light of
experience.

The data importer should process the transferred personal data only on behalf of the data exporter
and in accordance with his instructions and the obligations contained in the clauses. In particular the
data importer should not disclose the personal data to a third party unless in accordance with certain
conditions. The data exporter should instruct the data importer throughout the duration of the data
processing Services to process the data in accordance with his instructions, the applicable data
protection laws and the obligations contained in the clauses. The transfer of personal data to
processors established outside the Community does not prejudice the fact that the processing
activities should be governed in any case by the applicable data protection law.

The standard contractual clauses should be enforceable not only by the organisations which are
parties to the contract, but also by the data subjects, in particular where the data subjects suffer
damage as a consequence of a breach of the contract.

The data subject should be entitled to take action and, where appropriate, receive compensation
from the data exporter who is the data controller of the personal data transferred. Exceptionally, the
data subject should also be entitled to take action, and, where appropriate, receive compensation
from the data importer in those cases, arising out of a breach by the data importer of any of his
obligations referred to in the second paragraph of clause 3, where the data exporter has factually
disappeared or has ceased to exist in law or has become insolvent.

In the event of a dispute between a data subject, who invokes the third-party beneficiary clause and
the data importer, which is not amicably resolved, the data importer should agree to provide the data
subject with the choice between mediation, arbitration or litigation. The extent to which the data
subject will have an effective choice should depend on the availability of reliable and recognised
systems of mediation and arbitration. Mediation by the data protection supervisory authorities of the
Member State in which the data exporter is established should be an option where they provide such
a service.

The contract should be governed by the law of the Member State in which the data exporter is
established enabling a third-party beneficiary to enforce a contract. Data subjects should be allowed
to be represented by associations or other bodies if they so wish and if authorised by national law.

The Working Party on the Protection of Individuals with regard to the processing of Personal Data
established under Article 29 of Directive 95/46/EC has delivered an opinion on the level of
protection provided under the standard contractual clauses annexed to this Decision, which has been
taken into account in the preparation of this Decision (1).

(20)

The measures provided for in this Decision are in accordance with the opinion of the Committee
established under Article 31 of Directive 95/46/EC,

HAS ADOPTED THIS DECISION:

Article 1

The standard contractual clauses set out in the Annex are considered as offering adequate safeguards with
respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards
the exercise of the corresponding rights as required by Article 26(2) of Directive 95/46/EC.

(1) Opinion No 7/2001 adopted by the Working Party on 13 September 2001 (DG MARKT….), available on the website

‘Europa’ hosted by the European Commission.

10.1.2002

EN

Official Journal of the European Communities

L 6/55

Article 2

This Decision concerns only the adequacy of protection provided by the standard contractual clauses set
out in the Annex for the transfer of personal data to processors. It does not affect the application of other
national provisions implementing Directive 95/46/EC that pertain to the processing of personal data within
the Member States.

This Decision shall apply to the transfer of personal data by controllers established in the Community to
recipients established outside the territory of the Community who act only as processors.

Article 3

For the purposes of this Decision:

(a) the definitions in Directive 95/46/EC shall apply;

(b) ‘special categories of data’ means the data referred to in Article 8 of that Directive;

(c) ‘supervisory authority’ means the authority referred to in Article 28 of that Directive;

(d) ‘data exporter’ means the controller who transfers the personal data;

(e) ‘data importer’ means the processor established in a third country who agrees to receive from the data
exporter personal data intended for processing on the data exporter's behalf after the transfer in
accordance with his instructions and the terms of this Decision and who is not subject to a third
country's system ensuring adequate protection;

(f) ‘applicable data protection law’ means the legislation protecting the fundamental rights and freedoms of
natural persons and, in particular, their right to privacy with respect to the processing of personal data
applicable to a data controller in the Member State in which the data exporter is established;

(g) ‘technical and organisational security measures’ means those measures aimed at protecting personal data
against accidental or unlawful destruction or accidental
loss, alteration, unauthorised disclosure or
access, in particular where the processing involves the transmission of data over a network, and against
all other unlawful forms of processing.

Article 4

1. Without prejudice to their powers to take action to ensure compliance with national provisions
adopted pursuant to Chapters II, III, V and VI of Directive 95/46/EC, the competent authorities in the
Member States may exercise their existing powers to prohibit or suspend data flows to third countries in
order to protect individuals with regard to the processing of their personal data in cases where:

(a) it is established that the law to which the data importer is subject imposes upon him requirements to
derogate from the applicable data protection law which go beyond the restrictions necessary in a
democratic society as provided for in Article 13 of Directive 95/46/EC where those requirements are
likely to have a substantial adverse effect on the guarantees provided by the applicable data protection
law and the standard contractual clauses; or

(b) a competent authority has established that the data importer has not respected the contractual clauses

in the Annex; or

(c) there is a substantial likelihood that the standard contractual clauses in the Annex are not being or will
not be complied with and the continuing transfer would create an imminent risk of grave harm to the
data subjects.

The prohibition or suspension pursuant to paragraph 1 shall be lifted as soon as the reasons for the

2.
suspension or prohibition no longer exist.

3. When Member States adopt measures pursuant to paragraphs 1 and 2, they shall, without delay,
inform the Commission which will forward the information to the other Member States.

L 6/56

EN

Official Journal of the European Communities

10.1.2002

Article 5

The Commission shall evaluate the operation of this Decision on the basis of available information three
years after its notification to the Member States. It shall submit a report on the findings to the Committee
established under Article 31 of Directive 95/46/EC. It shall include any evidence that could affect the
evaluation concerning the adequacy of the standard contractual clauses in the Annex and any evidence that
this Decision is being applied in a discriminatory way.

This Decision shall apply from 3 April 2002.

Article 6

Article 7

This Decision is addressed to the Member States.

Done at Brussels, 27 December 2001.

For the Commission

Frederik BOLKESTEIN

Member of the Commission

10.1.2002

EN

Official Journal of the European Communities

L 6/57

ANNEX

L 6/58

EN

Official Journal of the European Communities

10.1.2002

10.1.2002

EN

Official Journal of the European Communities

L 6/59

L 6/60

EN

Official Journal of the European Communities

10.1.2002

10.1.2002

EN

Official Journal of the European Communities

L 6/61

Appendix 1

L 6/62

EN

Official Journal of the European Communities

10.1.2002

Appendix 2