On March 5, 2005, the Article 29 Working Party, an independent European advisory body on data protection and privacy, adopted Opinion 3/2009 (.pdf). The opinion comments on European Commission proposals designed to ensure that all data processors, including contractors hired by other data processors, are contractually required to protect sensitive data. Those proposals, contained in a Draft Commision decision which has not yet been made public, would update the standard contract clauses for the transfer of personal data to processors outside the European Union. As the Working Party explains, the Draft Commission decision proposes to update the standard contract clauses to reflect increasingly common “global outsourcing,” in which data is transferred from controller to processor to sub-processor, and often to subsequent “sub-sub processors.” In their current form, “the standard contractual clauses of 2002/16/EC do not provide a means to deal with these complex onward transfers.” Thus, the Draft Commission decision includes additional contract clauses to address these multi-layered transfers, and the Working Party Opinion comments on the proposed clauses.
Recognizing that the “current organisational pattern of worldwide markets” includes “long chains of sub-processors,” the Working Party announces its acceptance of “a multi-layered sub processing clause, on condition that appropriate safeguards are laid down to protect data subjects.” To ensure that protection, the Working Party suggests that sub-processing decisions should be accompanied by “careful assessment of the specific requirements and features of the processing operations,” with particular attention devoted to ensuring that the initial purpose for which the controller transferred the data is not altered. The Working Party also recommends that data exporters adopt policies and procedures to protect the rights of data subjects, such as identifying a specific corporate contact for data subjects.
The Working Party concludes that the proposed clauses adequately ensure that sub processing operations maintain the same level of protection reflected in the standard contractual clauses. At the same time, exporters are advised to keep a list of processors and sub processors in the contractual chain, and data protection authorities are encouraged to audit data importers and sub processors. The Working Party also recommends that the law of the data exporter’s state apply to sub processing contracts.
There is some debate as to whether all of Working Party’s proposals are feasible. For example, Hunton and Williams, which has been involved in the International Chamber of Commerce’s efforts to update the standard contractual clauses, has questioned the viability of audits of sub-processors located outside the EU, as well as the workability of applying the law of the data controller’s country to agreements between processors and sub-processors.
The Draft Commission decision is not yet public. According to a BNA article, the decision will now move to the Article 31 Committee of member state representatives. 8 PVLR 457. If the Article 31 Committee supports the proposal, it will move to the European Parliament, which will have 30 days to examine it and issue a recommendation before the decision is adopted.
Links:
- Opinion 3/2009 on the Draft Commission Decision on standard contractual clauses for the transfer of personal data to processors established in third countries, under Directive 95/46/EC is available here.