As per the Chapter 5 of GDPR[1], personal data may only be transferred to third countries or to international organizations from a data controller which falls under the jurisdiction of the European Union (“EU”)/European Economic Area (“EEA”) if the adequate level of protection to data subjects’ rights are provided by appropriate safeguards or under some specific circumstances[2] without appropriate safeguards. Transferring personal data to the countries outside the protection of GDPR is defined as a restricted transfer[3]. In order to conduct restricted transfers, signing Standard Contractual Clauses (“Model Clauses”, “SCC”), which includes a third-party beneficiary clause that enables data subjects to exercise contractual rights even though they are not a party to the contract, is the most practical and simple way to ensure such adequate protection level[4].

European Commission has approved four different Model Clauses to indicate a proof of adequate data protection regarding transfers of personal data to a third country which does not ensure an adequate level of protection as per the Article 26(4)[5] of Directive 95/46/EC[6]. Since Set I Controller to Processor Model Clauses was replaced by Set II Controller to Processor Model Clauses[7] and cannot be used anymore, currently, there are three versions of SCCs which are still in effect and can be used to provide appropriate safeguards pursuant to the Article 46(5) of GDPR including one version for controller to processor and two versions of controller to controller. In this note, Model Clauses will be introduced and basics on Model Clauses will be addressed.

Controller to controller transfers

Controller to controller Model Clauses are designed to be used where both parties are data controllers and the receiving party is subject to a third country’s legal system that does not ensure the adequate protection for data subjects’ rights. These Model Clauses are feasible for B2B operations which includes cross border personal data transfers between parties. For example, where an EU based company and a non-EU based company enter into a business relationship that requires them to send personal data of their employees in order to achieve mutual goals, controller to controller Model Clauses may constitute a legal base for the data transfer. However, if one of the parties acts as a data processor, controller to controller Model Clauses cannot be used for such transfers.

There are two versions of controller to controller Model Clauses which may be used at the choice of the parties depending on the nature of personal data in subject and other factors. Compared to the Set I Controller to Controller Model Clauses[8][9], Set II Controller to Controller Model Clauses[10] has more flexible provisions for parties. While Set I Controller to Controller Model Clauses stipulates joint and several liability for parties, Set II Controller to Controller Model Clauses which was summited by the International Chamber of Commerce and other business associations so that operators would have a more business-friendly SCC option, offers a liability regime that parties would be liable for merely their own breach of their contractual obligations. Moreover, Set II Controller to Controller Model Clauses offers an option for data importers on the laws and regulations which data processing will be conducted in accordance with it under the Clause II(h).

Additionally, parties are free to include any other clauses on business related issues related to all versions of Model Clauses, as long as they do not contradict the genuine provisions of SCCs.

Controller to processor transfers

In order to facilitate a legal base for a restricted transfer, there is one version of Set II Controller to Processor Model Clauses[11][12] that can be used to ensure an adequate level of data protection. For the purpose of providing adequate level of data protection, Set II Controller to Processor Model Clauses stipulates third-party beneficiary right for data subjects that enables them to enforce any breach of the importer, exporter, or even sub processor’s contractual obligations.

Set II Controller to Processor Model Clauses are structured in a way that they can merely be used for the restricted transfers which includes a data exporter as the EEA based data controller and a data importer as the non EEA based data processor. Therefore, such Model Clauses cannot be used for the scenarios where an EEA based processor is transferring data to a non EEA based sub processor[13]. On the other hand, where data is transferred to a non EEA based data processor and afterwards to a sub processor engaged by such non EEA based processor, the sub processor can co-sign Set II Controller to Processor Model Clauses signed between parties. In such scenario, such non-EEA based processor as the data importer shall remain fully liable towards the data exporter for the performance of the sub processor's obligations under Set II Controller to Processor Model Clauses.

Furthermore, controllers have to take into consideration that signing merely Set II Controller to Processor Model Clauses for processing activities shall not release them from their obligations under Article 28 of GDPR. Therefore, signing Model Clauses and fulfilling requirements of data processing contracts in terms of Article 28(3)[14] of GDPR have to be assessed separately and full compliance has to be achieved regarding both provisions of restricted transfer and data processing.

 

Author: Aslı Naz Ünlü



[1] Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).

[2] See also for more information on the derogations stipulated under the GDPR for restricted transfers, https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_2_2018_derogations_en.pdf.

[3] The Information Commissioner’s Office; Restricted transfer is a transfer of personal data outside the protection of the GDPR; https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers/.

[4] See also for more information on other possible ways to ensure that the data transfer is subject to appropriate safeguards which are listed in the GDPR; https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers/.

[5] Article 26(4) of Directive 95/46/EC; “Where the Commission decides, in accordance with the procedure referred to in Article 31(2), that certain standard contractual clauses offer sufficient safeguards as required by paragraph 2, Member States shall take the necessary measures to comply with the Commission's decision.”

[6] Directive 95/46/EC of The European Parliament and of The Councıl of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“Directive 95/46/EC”).

[7] Set II SCC approved with the Commission Decision 2010/87/EU dated February 5, 2010 replaced Set I SCC approved with the Commission Decision 2002/16/EC dated December 27, 2001 (“Set II Controller to Processor Model Clauses”); see for the full text, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010D0087&from=en.

[8] Set I SCC approved with the Commission Decision 2001/497/EC dated June 15, 2001 (“Set I Controller to Controller Model Clauses”); see for the full text, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32001D0497&from=en

[9] Set I Controller to Controller Model Clauses and Set II Controller to Processor Model Clauses was amended with the Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses.

[10] Set II SCC approved with the Commission Decision 2004/915/EC dated December 27, 2004 (“Set II Controller to Controller Model Clauses”); see for the full text, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32004D0915&from=EN.

[11] Set II SCC approved with the Commission Decision 2010/87/EU dated February 5, 2010 replaced Set I SCC approved with the Commission Decision 2002/16/EC dated December 27, 2001 (“Set II Controller to Processor Model Clauses”); see for the full text, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010D0087&from=en.

[12] The validity of the Commission Decision 2010/87/EU is subject to a dispute which is in progress in the European Court of Justice, See case documents of C-311/18 - Facebook Ireland and Schrems.

[13] Set II Controller to Processor Model Clauses can be signed between an EEA based processor and a non EEA based sub processor, if there is clear mandate from the controller to the processor in order for the processor to use Set II Controller to Processor Model Clauses in the controller’s name and behalf; Article 29 Data Protection Working Party, FAQs in order to address some issues raised by the entry into force of the EU Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC, July 12, 2010, p. 4.

[14] Pursuant to Article 28(3) data processing contracts have to include the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller, and in particular stipulate specific provisions, see full text of Article 28(3) of GDPR.