The Article 29 Working Party adopted a set of answers to frequently asked questions on 12 July ‘in order to address some issues raised by the entry into force of the EU Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC’.
In short, the FAQs are intended to address some issues raised by the application of the New Model Clauses since they entered into force on 15 May 2010. The Working Party states that the document reflects the harmonised position of the European data protection authorities and may be updated as required.
The FAQs and responses can be read in full here. The issues covered range from the relatively basic, of the kind that perhaps might have been resolved by reading the material properly, to the very detailed. By way of examples, the following are Q1 and Q5.
1) Do Model Clauses 2010/87/EU apply when personal data is transferred from an EEA-based controller to an EEA-based processor and then to a non-EEA-based subprocessor?
No. As stated under recital 23 of the Commission decision, the Decision applies only to subcontracting by a data processor established in a third country of his processing services to a subprocessor established in a third country.
5) When a data importer transfers data to a sub processor who provides services to the data importer for several data exporters, is it possible to make use of one single contract between the data importer and the sub processor?
No. It is not possible to sign just one contract for all. Appendix 1 to the contract will always be different since the identity of the data exporter will vary and probably also the categories of data, the data subjects, and the description of the processing operation.
Nevertheless, parties may decide to sign each contract making a reference to more generic agreements, such as the content of Model Clauses 2010/87/EU and possibly its Appendix 2 relating to technical measures (if they are the same for the different contracts and if they are accepted by the data importer and meet the data exporters’ requirements).
