2004/915/EC: Commission Decision of 27 December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries (notified under document number C(2004) 5271)Text with EEA relevance
Date: 2004-12-27
Institutions: European Commission
Subjects: confidentiality, contract terms, cross-frontier data flow, fundamental rights, personal data, protection of privacy

L 385/74

EN

Official Journal of the European Union

29.12.2004

COMMISSION DECISION

of 27 December 2004

amending Decision 2001/497/EC as regards the introduction of an alternative set of standard
contractual clauses for the transfer of personal data to third countries

(notified under document number C(2004) 5271)

(Text with EEA relevance)

(2004/915/EC)

THE COMMISSION OF THE EUROPEAN COMMUNITIES,

standard contractual clauses
laid down in Decision
2001/497/EC while making use of different mechanisms.

Having regard to the Treaty
Community,

establishing the European

regard to Directive 95/46/EC of

Having
the European
Parliament and of the Council of 24 October 1995 on the
protection of
individuals with regard to the processing of
personal data and on the free movement of such data (1), and
in particular Article 26(4) thereof,

Whereas:

(1)

In order to facilitate data flows from the Community, it
is desirable for data controllers to be able to perform
data transfers globally under a single set of data
protection rules. In the absence of global data protection
standard contractual
standards,
an
important
tool allowing the transfer of personal data
from all Member States under a common set of rules.
Commission Decision 2001/497/EC of 15 June 2001 on
standard contractual clauses for the transfer of personal
data to third countries under Directive 95/46/EC (2)
therefore lays down a model set of standard contractual
clauses which ensures
the
adequate
transfer of data to third countries.

clauses provide

safeguards

for

(2)

Much experience has been gained since the adoption of
that Decision. In addition, a coalition of business asso-
ciations (3) has submitted a set of alternative standard
contractual clauses designed to provide a level of data
protection equivalent to that provided for by the set of

(1) OJ L 281, 23.11.95, p. 31. Directive as amended by Regulation (EC)

No 1883/2003 (OJ L 284, 31.10.2003, p. 1).

(2) OJ L 181, 4.7.2001, p. 19.
(3) The International Chamber of Commerce (ICC),

Japan Business
in Europe (JBCE), European Information and Communi-
Council
cations Technology Association (EICTA), EU Committee of
the
American Chamber of Commerce in Belgium (Amcham), Confe-
deration of British Industry (CBI),
International Communication
Round Table
(ICRT) and the Federation of European Direct
Marketing Associations (FEDMA).

(3)

(4)

(5)

third country, data
importers

Since the use of standard contractual clauses for interna-
tional data transfers is voluntary as standard contractual
clauses are only one of
several possibilities under
for lawfully transferring personal
Directive 95/46/EC,
exporters
data
in the
to a
Community and data
in third countries
should be free to choose any of the sets of standard
contractual clauses, or to choose some other legal basis
for data transfer. As each set as a whole forms a model,
data exporters should not, however, be allowed to amend
these sets or totally or partially merge them in any
manner.

The standard contract clauses submitted by the business
associations aim at
increasing the use of contractual
clauses among operators by mechanisms such as more
flexible auditing requirements and more detailed rules on
the right of access.

Moreover, as an alternative to the system of joint and
several
liability provided for in Decision 2001/497/EC,
the set now submitted contains a liability regime based
on due diligence obligations where the data exporter and
the data importer would be liable vis-à-vis the data
subjects for their respective breach of their contractual
obligations; the data exporter is also liable for not using
reasonable efforts to determine that the data importer is
able to satisfy its legal obligations under the clauses (culpa
in eligendo) and the data subject can take action against
the data exporter in this respect. The enforcement of
standard contractual
clause I(b) of
in
clauses is of particular importance in this regard,
particular
the
data exporter to carry out audits on the data importers’
premises or to request evidence of sufficient financial
resources to fulfil its responsibilities.

in connection with the possibility for

the new set of

29.12.2004

EN

Official Journal of the European Union

L 385/75

(6)

(7)

(8)

(9)

(10)

If

the data exporter

As regards the exercise of third party beneficiary rights
by the data subjects, greater involvement of the data
exporter in the resolution of data subjects' complaints
is provided for, with the data exporter being obliged to
make contact with the data importer and, if necessary,
enforce the contract within the normal period of one
refused to enforce the
month.
still
contract and the breach by the data importer
continues,
the
the data subject may then enforce
the data importer and eventually sue
clauses against
him in a Member State. This acceptance of jurisdiction
and the agreement
to comply with a decision of a
competent court or data protection authority does not
prejudice any procedural rights of data importers estab-
lished in third countries, such as rights of appeal.

is

can more

appropriate

to provide

In order, however, to prevent abuses with this additional
that data
flexibility,
it
protection authorities
easily prohibit or
suspend data
transfers based on the new set of
standard contractual clauses in those cases where the
to
to take appropriate steps
data exporter
enforce
data
obligations
importer or the latter refuses to cooperate in good
faith with competent supervisory data protection autho-
rities.

contractual

against

refuses

the

(11)

In order to assess the operation of the amendments to
Decision 2001/497/EC,
the
it
Commission evaluates them three years after their noti-
fication to the Member States

appropriate

that

is

(12) Decision 2001/497/EC should be amended accordingly.

(13)

The measures provided for
in this Decision are in
accordance with the opinion of the Committee estab-
lished under Article 31 of Directive 95/46/EC,

HAS ADOPTED THIS DECISION:

Article 1

Decision 2001/497/EC is amended as follows:

1. In Article 1 the following paragraph is added:

to the

The use of standard contractual clauses will be made
without prejudice
application of national
provisions adopted pursuant to Directive 95/46/EC or
the European Parliament
to Directive 2002//58/EC of
and of
concerning the processing of
the Council
personal data and the protection of privacy in the elec-
tronic communications sector (Directive on privacy and
electronic communications) (1), in particular as far as the
sending of commercial communications for the purposes
of direct marketing is concerned.

‘Data controllers may choose either of the sets I or II in the
Annex. However,
they may not amend the clauses nor
combine individual clauses or the sets.’

2. In Article 4 paragraphs 2 and 3 are replaced by the

following:

On that basis, the safeguards contained in the submitted
standard contractual
considered as
adequate within the meaning of Article 26(2) of
Directive 95/46/EC.

can be

clauses

The Working Party on the Protection of Individuals with
regard to the Processing of Personal Data established
under Article 29 of Directive 95/46/EC has delivered
an opinion (2) on the level of protection provided
under the submitted standard contractual clauses which
has been taken into account.

(1) OJ L 201, 31.7.2002, p. 37.
(2) Opinion No 8/2003, available at: http://europa.eu.int/comm/privacy

‘2.
For the purposes of paragraph 1, where the data
controller adduces adequate safeguards on the basis of the
standard contractual clauses contained in set II in the Annex,
the competent data protection authorities are entitled to
exercise their existing powers to prohibit or suspend data
flows in either of the following cases:

(a) refusal of the data importer to cooperate in good faith
with the data protection authorities, or to comply with
their clear obligations under the contract;

(b) refusal of the data exporter to take appropriate steps to
enforce the contract against the data importer within the
normal period of one month after notice by the
competent data protection authority to the data exporter.

L 385/76

EN

Official Journal of the European Union

29.12.2004

in bad
For the purposes of the first subparagraph, refusal
faith or refusal to enforce the contract by the data importer
shall not include cases in which cooperation or enforcement
would conflict with mandatory requirements of the national
legislation applicable to the data importer which do not go
beyond what is necessary in a democratic society on the
basis of one of
the interests listed in Article 13(1) of
Directive 95/46/EC, in particular sanctions as laid down in
tax-reporting
international
reporting
requirements
requirements.

instruments,
anti-money-laundering

and/or national

or

For the purposes of point (a) of the first subparagraph co-
operation may include, in particular, the submission of the
data importer’s data processing facilities for audit or the
obligation to abide by the advice of the data protection
supervisory authority in the Community.

3.
The prohibition or suspension pursuant to paragraphs
1 and 2 shall be lifted as soon as the reasons for the prohi-
bition or suspension no longer exist.

4. When Member States adopt measures pursuant
to
paragraphs 1, 2 and 3, they shall without delay inform the
Commission which will forward the information to the other
Member States.’.

3. In Article 5 the first sentence is replaced by the following:

‘The Commission shall evaluate the operation of
this
Decision on the basis of available information three years
after its notification and the notification of any amendment
thereto to the Member States.’.

4. The Annex is amended as follows:

1. After the title the term ‘SET I’ is inserted.

2. The text set out in the Annex to this Decision is added.

Article 2

This Decision shall apply from 1 April 2005.

Article 3

This Decision is addressed to the Member States.

Done at Brussels, 27 December 2004.

For the Commission

Charlie McCREEVY
Member of the Commission

29.12.2004

EN

Official Journal of the European Union

L 385/77

ANNEX
‘SET II

Standard contractual clauses for the transfer of personal data from the Community to third countries (controller
to controller transfers)

Data transfer agreement

between

_____________________________________________________________________________________ (name)

__________________________________________________________________________________ (address and country of establishment)

hereinafter “data exporter”)

and

_____________________________________________________________________________________ (name)

__________________________________________________________________________________ (address and country of establishment)

hereinafter “data importer”

each a “party”; together “the parties”.

Definitions

For the purposes of the clauses:

(a) “personal data”, “special categories of data/sensitive data”, “process/processing”, “controller”, “processor”, “data subject”
and “supervisory authority/authority” shall have the same meaning as in Directive 95/46/EC of 24 October 1995
(whereby “the authority” shall mean the competent data protection authority in the territory in which the data
exporter is established);

(b) “the data exporter” shall mean the controller who transfers the personal data;

(c) “the data importer” shall mean the controller who agrees to receive from the data exporter personal data for further
processing in accordance with the terms of these clauses and who is not subject to a third country’s system ensuring
adequate protection;

(d) “clauses” shall mean these contractual clauses, which are a free-standing document

that does not

incorporate

commercial business terms established by the parties under separate commercial arrangements.

The details of the transfer (as well as the personal data covered) are specified in Annex B, which forms an integral part of
the clauses.

I.

Obligations of the data exporter

The data exporter warrants and undertakes that:

(a) The personal data have been collected, processed and transferred in accordance with the laws applicable to the

data exporter.

(b) It has used reasonable efforts to determine that the data importer is able to satisfy its legal obligations under

these clauses.

(c) It will provide the data importer, when so requested, with copies of relevant data protection laws or references to
them (where relevant, and not including legal advice) of the country in which the data exporter is established.

L 385/78

EN

Official Journal of the European Union

29.12.2004

(d) It will respond to enquiries from data subjects and the authority concerning processing of the personal data by
the data importer, unless the parties have agreed that the data importer will so respond, in which case the data
exporter will still respond to the extent reasonably possible and with the information reasonably available to it if
the data importer is unwilling or unable to respond. Responses will be made within a reasonable time.

(e) It will make available, upon request, a copy of the clauses to data subjects who are third party beneficiaries under
clause III, unless the clauses contain confidential information, in which case it may remove such information.
Where information is removed, the data exporter shall inform data subjects in writing of the reason for removal
and of their right to draw the removal to the attention of the authority. However, the data exporter shall abide
by a decision of the authority regarding access to the full text of the clauses by data subjects, as long as data
subjects have agreed to respect the confidentiality of the confidential information removed. The data exporter
shall also provide a copy of the clauses to the authority where required.

II. Obligations of the data importer

The data importer warrants and undertakes that:

(a) It will have in place appropriate technical and organisational measures to protect the personal data against
accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, and which
provide a level of security appropriate to the risk represented by the processing and the nature of the data to be
protected.

(b) It will have in place procedures so that any third party it authorises to have access to the personal data,
including processors, will respect and maintain the confidentiality and security of the personal data. Any
person acting under the authority of the data importer,
including a data processor, shall be obligated to
process the personal data only on instructions from the data importer. This provision does not apply to
persons authorised or required by law or regulation to have access to the personal data.

(c) It has no reason to believe, at the time of entering into these clauses, in the existence of any local laws that
would have a substantial adverse effect on the guarantees provided for under these clauses, and it will inform the
data exporter (which will pass such notification on to the authority where required) if it becomes aware of any
such laws.

(d) It will process the personal data for purposes described in Annex B, and has the legal authority to give the

warranties and fulfil the undertakings set out in these clauses.

(e) It will identify to the data exporter a contact point within its organisation authorised to respond to enquiries
concerning processing of the personal data, and will cooperate in good faith with the data exporter, the data
subject and the authority concerning all such enquiries within a reasonable time. In case of legal dissolution of
the data exporter, or if the parties have so agreed, the data importer will assume responsibility for compliance
with the provisions of clause I(e).

(f) At the request of the data exporter, it will provide the data exporter with evidence of financial resources sufficient

to fulfil its responsibilities under clause III (which may include insurance coverage).

(g) Upon reasonable request of the data exporter, it will submit its data processing facilities, data files and docu-
mentation needed for processing to reviewing, auditing and/or certifying by the data exporter (or any inde-
pendent or impartial inspection agents or auditors, selected by the data exporter and not reasonably objected to
by the data importer) to ascertain compliance with the warranties and undertakings in these clauses, with
reasonable notice and during regular business hours. The request will be subject to any necessary consent or
approval from a regulatory or supervisory authority within the country of the data importer, which consent or
approval the data importer will attempt to obtain in a timely fashion.

29.12.2004

EN

Official Journal of the European Union

L 385/79

(h) It will process the personal data, at its option, in accordance with:

(i) the data protection laws of the country in which the data exporter is established, or

(ii) the relevant provisions (1) of any Commission decision pursuant to Article 25(6) of Directive 95/46/EC,
where the data importer complies with the relevant provisions of such an authorisation or decision and is
based in a country to which such an authorisation or decision pertains, but is not covered by such
authorisation or decision for the purposes of the transfer(s) of the personal data (2), or

(iii) the data processing principles set forth in Annex A.

Data importer to indicate which option it selects: ______________________________________________

Initials of data importer: _____________________________________________________________________;

(i) It will not disclose or transfer the personal data to a third party data controller located outside the European

Economic Area (EEA) unless it notifies the data exporter about the transfer and

(i) the third party data controller processes the personal data in accordance with a Commission decision

finding that a third country provides adequate protection, or

(ii) the third party data controller becomes a signatory to these clauses or another data transfer agreement

approved by a competent authority in the EU, or

(iii) data subjects have been given the opportunity to object, after having been informed of the purposes of the
transfer, the categories of recipients and the fact that the countries to which data is exported may have
different data protection standards, or

(iv) with regard to onward transfers of sensitive data, data subjects have given their unambiguous consent to the

onward transfer

III.

Liability and third party rights

(a) Each party shall be liable to the other parties for damages it causes by any breach of these clauses. Liability as
between the parties is limited to actual damage suffered. Punitive damages (i.e. damages intended to punish a
party for its outrageous conduct) are specifically excluded. Each party shall be liable to data subjects for damages
it causes by any breach of third party rights under these clauses. This does not affect the liability of the data
exporter under its data protection law.

(b) The parties agree that a data subject shall have the right to enforce as a third party beneficiary this clause and
clauses I(b), I(d), I(e), II(a), II(c), II(d), II(e), II(h), II(i), III(a), V, VI(d) and VII against the data importer or the data
exporter, for their respective breach of their contractual obligations, with regard to his personal data, and accept
jurisdiction for this purpose in the data exporter’s country of establishment. In cases involving allegations of
breach by the data importer, the data subject must first request the data exporter to take appropriate action to
enforce his rights against the data importer; if the data exporter does not take such action within a reasonable
period (which under normal circumstances would be one month), the data subject may then enforce his rights
against the data importer directly. A data subject is entitled to proceed directly against a data exporter that has
failed to use reasonable efforts to determine that the data importer is able to satisfy its legal obligations under
these clauses (the data exporter shall have the burden to prove that it took reasonable efforts).

(1) “Relevant provisions” means those provisions of any authorisation or decision except for the enforcement provisions of any author-

isation or decision (which shall be governed by these clauses).

(2) However, the provisions of Annex A.5 concerning rights of access, rectification, deletion and objection must be applied when this

option is chosen and take precedence over any comparable provisions of the Commission Decision selected.

L 385/80

EN

Official Journal of the European Union

29.12.2004

IV.

Law applicable to the clauses

These clauses shall be governed by the law of the country in which the data exporter is established, with the
exception of the laws and regulations relating to processing of the personal data by the data importer under clause
II(h), which shall apply only if so selected by the data importer under that clause.

V. Resolution of disputes with data subjects or the authority

(a) In the event of a dispute or claim brought by a data subject or the authority concerning the processing of the
personal data against either or both of the parties, the parties will inform each other about any such disputes or
claims, and will cooperate with a view to settling them amicably in a timely fashion.

(b) The parties agree to respond to any generally available non-binding mediation procedure initiated by a data
subject or by the authority. If they do participate in the proceedings, the parties may elect to do so remotely
(such as by telephone or other electronic means). The parties also agree to consider participating in any other
arbitration, mediation or other dispute resolution proceedings developed for data protection disputes.

(c) Each party shall abide by a decision of a competent court of the data exporter’s country of establishment or of

the authority which is final and against which no further appeal is possible.

VI. Termination

(a) In the event that the data importer is in breach of its obligations under these clauses, then the data exporter may
temporarily suspend the transfer of personal data to the data importer until the breach is repaired or the contract
is terminated.

(b) In the event that:

(i) the transfer of personal data to the data importer has been temporarily suspended by the data exporter for

longer than one month pursuant to paragraph (a);

(ii) compliance by the data importer with these clauses would put it in breach of its legal or regulatory

obligations in the country of import;

(iii) the data importer is in substantial or persistent breach of any warranties or undertakings given by it under

these clauses;

(iv) a final decision against which no further appeal is possible of a competent court of the data exporter’s
country of establishment or of the authority rules that there has been a breach of the clauses by the data
importer or the data exporter; or

(v) a petition is presented for the administration or winding up of the data importer, whether in its personal or
business capacity, which petition is not dismissed within the applicable period for such dismissal under
applicable law; a winding up order is made; a receiver is appointed over any of its assets; a trustee in
bankruptcy is appointed,
if the data importer is an individual; a company voluntary arrangement is
commenced by it; or any equivalent event in any jurisdiction occurs

then the data exporter, without prejudice to any other rights which it may have against the data importer, shall
be entitled to terminate these clauses, in which case the authority shall be informed where required. In cases
covered by (i), (ii), or (iv) above the data importer may also terminate these clauses.

29.12.2004

EN

Official Journal of the European Union

L 385/81

(c) Either party may terminate these clauses if (i) any Commission positive adequacy decision under Article 25(6) of
Directive 95/46/EC (or any superseding text) is issued in relation to the country (or a sector thereof) to which
the data is transferred and processed by the data importer, or (ii) Directive 95/46/EC (or any superseding text)
becomes directly applicable in such country.

(d) The parties agree that the termination of these clauses at any time, in any circumstances and for whatever reason
(except for termination under clause VI(c)) does not exempt them from the obligations and/or conditions under
the clauses as regards the processing of the personal data transferred.

VII. Variation of these clauses

The parties may not modify these clauses except to update any information in Annex B, in which case they will
inform the authority where required. This does not preclude the parties from adding additional commercial clauses
where required.

VIII. Description of the Transfer

The details of the transfer and of the personal data are specified in Annex B. The parties agree that Annex B may
contain confidential business information which they will not disclose to third parties, except as required by law or
in response to a competent regulatory or government agency, or as required under clause I(e). The parties may
execute additional annexes to cover additional transfers, which will be submitted to the authority where required.
Annex B may, in the alternative, be drafted to cover multiple transfers.

Dated: _____________________________________

___________________________________________

___________________________________________

FOR DATA IMPORTER

FOR DATA EXPORTER

.................................................................................................

..................................................................................................

.................................................................................................

..................................................................................................

.................................................................................................

..................................................................................................

L 385/82

EN

Official Journal of the European Union

29.12.2004

ANNEX A

DATA PROCESSING PRINCIPLES

1. Purpose limitation: Personal data may be processed and subsequently used or further communicated only for purposes

described in Annex B or subsequently authorised by the data subject.

2. Data quality and proportionality: Personal data must be accurate and, where necessary, kept up to date. The personal
data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and
further processed.

3. Transparency: Data subjects must be provided with information necessary to ensure fair processing (such as infor-
mation about the purposes of processing and about the transfer), unless such information has already been given by
the data exporter.

4. Security and confidentiality: Technical and organisational security measures must be taken by the data controller that
are appropriate to the risks, such as against accidental or unlawful destruction or accidental
loss, alteration,
unauthorised disclosure or access, presented by the processing. Any person acting under the authority of the data
controller, including a processor, must not process the data except on instructions from the data controller.

5. Rights of access, rectification, deletion and objection: As provided in Article 12 of Directive 95/46/EC, data subjects
must, whether directly or via a third party, be provided with the personal information about them that an organisation
holds, except for requests which are manifestly abusive, based on unreasonable intervals or their number or repetitive
or systematic nature, or for which access need not be granted under the law of the country of the data exporter.
Provided that the authority has given its prior approval, access need also not be granted when doing so would be
likely to seriously harm the interests of the data importer or other organisations dealing with the data importer and
such interests are not overridden by the interests for fundamental rights and freedoms of the data subject. The sources
of the personal data need not be identified when this is not possible by reasonable efforts, or where the rights of
persons other than the individual would be violated. Data subjects must be able to have the personal information
about them rectified, amended, or deleted where it is inaccurate or processed against these principles. If there are
compelling grounds to doubt the legitimacy of the request, the organisation may require further justifications before
proceeding to rectification, amendment or deletion. Notification of any rectification, amendment or deletion to third
parties to whom the data have been disclosed need not be made when this involves a disproportionate effort. A data
subject must also be able to object to the processing of the personal data relating to him if there are compelling
legitimate grounds relating to his particular situation. The burden of proof for any refusal rests on the data importer,
and the data subject may always challenge a refusal before the authority.

6. Sensitive data: The data importer shall take such additional measures (e.g. relating to security) as are necessary to

protect such sensitive data in accordance with its obligations under clause II.

7. Data used for marketing purposes: Where data are processed for the purposes of direct marketing, effective procedures

should exist allowing the data subject at any time to “opt-out” from having his data used for such purposes.

8. Automated decisions: For purposes hereof “automated decision” shall mean a decision by the data exporter or the data
importer which produces legal effects concerning a data subject or significantly affects a data subject and which is
based solely on automated processing of personal data intended to evaluate certain personal aspects relating to him,
such as his performance at work, creditworthiness, reliability, conduct, etc. The data importer shall not make any
automated decisions concerning data subjects, except when:

(a)

(i) such decisions are made by the data importer in entering into or performing a contract with the data subject,

and

(ii) (the data subject is given an opportunity to discuss the results of a relevant automated decision with a
representative of the parties making such decision or otherwise to make representations to that parties.

or

(b) where otherwise provided by the law of the data exporter.

29.12.2004

EN

Official Journal of the European Union

L 385/83

ANNEX B

DESCRIPTION OF THE TRANSFER

(To be completed by the parties)

L 385/84

EN

Official Journal of the European Union

29.12.2004

Indemnification between the data exporter and data importer:

ILLUSTRATIVE COMMERCIAL CLAUSES (OPTIONAL)

“The parties will indemnify each other and hold each other harmless from any cost, charge, damages, expense or loss
which they cause each other as a result of their breach of any of the provisions of these clauses. Indemnification
hereunder is contingent upon (a) the party(ies) to be indemnified (the “indemnified party(ies)”) promptly notifying the
other party(ies) (the “indemnifying party(ies)”) of a claim, (b) the indemnifying party(ies) having sole control of the
defence and settlement of any such claim, and (c) the indemnified party(ies) providing reasonable cooperation and
assistance to the indemnifying party(ies) in defence of such claim.”.

Dispute resolution between the data exporter and data importer (the parties may of course substitute any other alternative dispute
resolution or jurisdictional clause):

“In the event of a dispute between the data importer and the data exporter concerning any alleged breach of any
provision of these clauses, such dispute shall be finally settled under the rules of arbitration of the International
Chamber of Commerce by one or more arbitrators appointed in accordance with the said rules. The place of arbitration
shall be [ ]. The number of arbitrators shall be [ ].”

Allocation of costs:

“Each party shall perform its obligations under these clauses at its own cost.”

Extra termination clause:

“In the event of termination of these clauses, the data importer must return all personal data and all copies of the
personal data subject to these clauses to the data exporter forthwith or, at the data exporter’s choice, will destroy all
copies of the same and certify to the data exporter that it has done so, unless the data importer is prevented by its
national law or local regulator from destroying or returning all or part of such data, in which event the data will be
kept confidential and will not be actively processed for any purpose. The data importer agrees that, if so requested by
the data exporter,
it will allow the data exporter, or an inspection agent selected by the data exporter and not
reasonably objected to by the data importer, access to its establishment to verify that this has been done, with
reasonable notice and during business hours.” ’.