Monday, 19 July 2010

EU controller processor model clauses - FAQs from Article 29 Working Party

I previously briefly mentioned the February 2010 version of the European Commission's Model standard contractual clauses for transfer of personal data to processors outside the EU (controller to processor).

EU privacy regulators the Article 29 Working Party have now produced FAQs in order to address some issues raised by the entry into force of the EU Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC, WP 176 of 12 July 2010, with some helpful guidance.

And no, the model clauses still don't apply when personal data is transferred from an EEA-based controller to an EEA-based processor and then to a non-EEA-based subprocessor. Though they suggest some workarounds.

©WH. This work is licensed under a Creative Commons Attribution Non-Commercial Share-Alike England 2.0 Licence. Please attribute to WH, Tech and Law, and link to the original blog post page. Moral rights asserted.