As per the Chapter 5 of GDPR[1],
personal data may only be transferred to third countries or to international
organizations from a data controller which falls under the jurisdiction of the
European Union (“EU”)/European Economic Area (“EEA”) if the adequate level of
protection to data subjects’ rights are provided by appropriate safeguards or under
some specific circumstances[2]
without appropriate safeguards. Transferring personal data to the countries outside
the protection of GDPR is defined as a restricted transfer[3].
In order to conduct restricted transfers, signing Standard Contractual Clauses (“Model
Clauses”, “SCC”), which includes a third-party beneficiary clause that enables
data subjects to exercise contractual rights even though they are not a party
to the contract, is the most practical and simple way to ensure such adequate
protection level[4].
European Commission has approved four different
Model Clauses to indicate a proof of adequate data protection regarding transfers
of personal data to a third country which does not ensure an adequate level of
protection as per the Article 26(4)[5]
of Directive 95/46/EC[6].
Since Set I Controller to Processor Model Clauses was replaced by Set II Controller
to Processor Model Clauses[7]
and cannot be used anymore, currently, there are three versions of SCCs which
are still in effect and can be used to provide appropriate safeguards pursuant
to the Article 46(5) of GDPR including one version for controller to processor
and two versions of controller to controller. In this note, Model Clauses will
be introduced and basics on Model Clauses will be addressed.
Controller to controller transfers
Controller to controller Model Clauses are designed
to be used where both parties are data controllers and the receiving party is subject
to a third country’s legal system that does not ensure the adequate protection
for data subjects’ rights. These Model Clauses are feasible for B2B operations
which includes cross border personal data transfers between parties. For example,
where an EU based company and a non-EU based company enter into a business
relationship that requires them to send personal data of their employees in
order to achieve mutual goals, controller to controller Model Clauses may
constitute a legal base for the data transfer. However, if one of the parties
acts as a data processor, controller to controller Model Clauses cannot be used
for such transfers.
There are two versions of controller to
controller Model Clauses which may be used at the choice of the parties depending
on the nature of personal data in subject and other factors. Compared to the Set
I Controller to Controller Model Clauses[8][9],
Set II Controller to Controller Model Clauses[10]
has more flexible provisions for parties. While Set I Controller to Controller
Model Clauses stipulates joint and several liability for parties, Set II Controller
to Controller Model Clauses which was summited by the International Chamber of
Commerce and other business associations so that operators would have a more
business-friendly SCC option, offers a liability regime that parties would be
liable for merely their own breach of their contractual obligations. Moreover, Set
II Controller to Controller Model Clauses offers an option for data importers
on the laws and regulations which data processing will be conducted in
accordance with it under the Clause II(h).
Additionally, parties are free to include any
other clauses on business related issues related to all versions of Model
Clauses, as long as they do not contradict the genuine provisions of SCCs.
Controller to processor transfers
In order to facilitate a legal base for a
restricted transfer, there is one version of Set II Controller to Processor
Model Clauses[11][12]
that can be used to ensure an adequate level of data protection. For the
purpose of providing adequate level of data protection, Set II Controller to
Processor Model Clauses stipulates third-party beneficiary right for data
subjects that enables them to enforce any breach of the importer, exporter, or
even sub processor’s contractual obligations.
Set II Controller to Processor Model Clauses
are structured in a way that they can merely be used for the restricted
transfers which includes a data exporter as the EEA based data controller and a
data importer as the non EEA based data processor. Therefore, such Model
Clauses cannot be used for the scenarios where an EEA based processor is
transferring data to a non EEA based sub processor[13].
On the other hand, where data is transferred to a non EEA based data processor and
afterwards to a sub processor engaged by such non EEA based processor, the sub processor
can co-sign Set II Controller to Processor Model Clauses signed between
parties. In such scenario, such non-EEA based processor as the data importer shall
remain fully liable towards the data exporter for the performance of the sub
processor's obligations under Set II Controller to Processor Model Clauses.
Furthermore, controllers have to take into
consideration that signing merely Set II Controller to Processor Model Clauses
for processing activities shall not release them from their obligations under
Article 28 of GDPR. Therefore, signing Model Clauses and fulfilling
requirements of data processing contracts in terms of Article 28(3)[14]
of GDPR have to be assessed separately and full compliance has to be achieved
regarding both provisions of restricted transfer and data processing.
Author: Aslı Naz Ünlü
[1] Regulation 2016/679/EU of the
European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive 95/46/EC (“GDPR”).
[2] See also for more information on
the derogations stipulated under the GDPR for restricted transfers, https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_2_2018_derogations_en.pdf.
[3] The Information Commissioner’s
Office; Restricted transfer is a transfer of personal data outside the
protection of the GDPR; https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers/.
[4] See also for more information on other
possible ways to ensure that the data transfer is subject to appropriate
safeguards which are listed in the GDPR; https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers/.
[5] Article 26(4) of Directive
95/46/EC; “Where the Commission decides,
in accordance with the procedure referred to in Article 31(2), that certain
standard contractual clauses offer sufficient safeguards as required by
paragraph 2, Member States shall take the necessary measures to comply with the
Commission's decision.”
[6] Directive 95/46/EC of The European
Parliament and of The Councıl of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and on the free
movement of such data (“Directive 95/46/EC”).
[7]
Set II SCC approved with the Commission
Decision 2010/87/EU dated February 5, 2010 replaced Set I SCC approved with the
Commission Decision 2002/16/EC dated December 27, 2001 (“Set II Controller to
Processor Model Clauses”); see for the full text, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010D0087&from=en.
[8]
Set I SCC approved with the
Commission Decision 2001/497/EC dated June 15, 2001 (“Set I Controller to Controller
Model Clauses”); see for the full text, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32001D0497&from=en
[9]
Set I Controller to Controller
Model Clauses and Set II Controller to Processor Model Clauses was amended with
the Commission Implementing Decision (EU) 2016/2297 of 16 December 2016
amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses.
[10]
Set II SCC approved with the
Commission Decision 2004/915/EC dated December 27, 2004 (“Set II Controller to
Controller Model Clauses”); see for the full text, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32004D0915&from=EN.
[11] Set II SCC approved with the Commission
Decision 2010/87/EU dated February 5, 2010 replaced Set I SCC approved with the
Commission Decision 2002/16/EC dated December 27, 2001 (“Set II Controller to
Processor Model Clauses”); see for the full text, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010D0087&from=en.
[12] The validity of the Commission Decision
2010/87/EU is subject to a dispute which is in progress in the European Court
of Justice, See case documents of C-311/18 - Facebook Ireland and Schrems.
[13] Set
II Controller to Processor Model Clauses can be signed between an EEA based
processor and a non EEA based sub processor, if there is clear mandate from the
controller to the processor in order for the processor to use Set II Controller
to Processor Model Clauses in the controller’s name and behalf; Article 29
Data Protection Working Party, FAQs in
order to address some issues raised by the entry into force of the EU
Commission Decision 2010/87/EU of 5 February 2010 on standard contractual
clauses for the transfer of personal data to processors established in third
countries under Directive 95/46/EC, July 12, 2010, p. 4.
[14] Pursuant to Article 28(3) data
processing contracts have to include the subject-matter and duration of the
processing, the nature and purpose of the processing, the type of personal data
and categories of data subjects and the obligations and rights of the
controller, and in particular stipulate specific provisions, see full text of
Article 28(3) of GDPR.