EU Adopts New Standard Contract Clauses for Foreign Processors

Last Friday, the European Commission adopted new "controller-processor" standard contractual clauses ("SCCs" or "model contract") to protect personal data transferred from Europe to a data processor located outside the EU/ EEA.  Existing contractual arrangements are grandfathered, but any new contracts with data processors must include the new version of the SCCs. 

The principal change from the 2002 controller-processor SCCs is that processing contractors are now obliged to obtain prior written consent from the customer before subcontracting any of the processing, and the subcontractor must be contractually bound to the same obligations that apply to the contractor.

Article 25 of the EU Data Protection Directive directs member states to prohibit the transfer of personal data to countries lacking similar legal protections, unless one of several limited exceptions applies or approved safeguards are in place.   EU-approved standard contract clauses between the data "exporter" and data "importer" are a common means of legitimizing data transfers to locations outside the European Economic Area -- the European Union plus Iceland, Liechtenstein, and Norway.  (SCCs are not used where the transfers are to a US company that participates in the international Safe Harbor program, or to a company relying on informed consent, nationally approved Binding Corporate Rules, or one of the other "derogations" under Article 26 of the Directive.)

The European Commission has approved two alternative sets of SCCs for use in transferring personal data to a data "controller" outside the EEA, and in 2002 the Commission approved a set of SCCs to be used when transferring data to a "processor."  The distinction between controllers and processors is not always clear in practice, but the basic concept is that a controller makes decisions about what data to collect and how to use it, while a processor merely performs operations on data only on behalf of the controller and according to its instructions.  Business process outsourcing in a non-EEA country such as the United States or India is a common context for using SCCs to protect employee and customer information or other personal data furnished by a European company. 

The concern addressed in the new controller-processor SCCs is that processors today often subcontract some processing, storage, and technical support functions to third parties.  This is particulary common in cloud computing, where several entities might be involved in handling and storing the data.  The new SCCs are designed to ensure that the company that remains responsible as the data controller in Europe is informed about any proposed subcontracting, and that all parties handling the data are subject to the same obligations of confidentiality and security.

The full text of the decision and the new SCCs are not yet posted on the Commission's website.  (They will ultimately appear on the "Model Contracts" page.)  A Commission spokesman described the decision on Friday, however, as follows:

"According to the newly adopted Decision, where a data importer (processor) intends to subcontract any of its processing operations performed on behalf of the EU data exporter (controller), it must first obtain the prior written consent of the data exporter. The written contract will impose the same obligations on the sub-processor as those imposed on the data importer under the standard contractual clauses."

The Commission reportedly will not require companies with existing controller-processor SCCs to replace those agreements with the new SCCs.  New processing agreements, however, must use the new set of controller-processor SCCs if they are to serve as a legal basis for data transfers outside the EEA.