Articles

WP 29 document on a new co-operation procedure regarding contractual clauses

WP 29 document on a new co-operation procedure regarding contractual clauses

WP 29 document on a new co-operation procedure regarding contractual clauses

30.04.2015

Working Party (“WP 29”) issued Working Document WP226. This document sets forth a co-operation procedure for issuing common opinions on contractual clauses that are considered compliant with the EC Model Clauses. Through this document the WP 29 wants to establish a more harmonized approach among the national data protection authorities (“DPAs”) throughout the multiple jurisdictions of Europe in approving EU Model Clauses.

The Model Clauses were adopted by the European Commission to enable companies to put in place sufficient safeguards for legally framing international data transfers outside the EEA. In principle, companies choosing to use such clauses may not change them unless they seek prior approval from the DPA of the Member State from where the transfer is taking place (“competent DPA”). Nevertheless, it is possible for companies to draft a contract that contains additional (commercial) clauses alongside these Model Clauses as long as there is no direct or indirect contradiction between them.

In many Member States, a company must obtain an authorization from the DPA—before the data transfer—for both the use of an ad hoc contract and the use of Model Clauses. In a situation where the company wants to transfer data from different EU/EEA countries, this obligation entails the risk that the DPAs in the different Member States would not reach the same conclusion regarding the same draft contract.

Through this Working Document, the WP 29 launches a procedure that will enable companies to obtain a coordinated position of the different DPAs regarding their proposed contract. DPAs are free to decide, based on the circumstances, whether such co-operation procedure is opportune or not.

As a first step in the co-operation procedure, the company needs to choose a lead DPA out of the several competent DPAs. In the Working Document, the WP 29 sets out different possible decisive factors that can guide the company in the decision-making process. The chosen lead DPA has the possibility to transfer the application to another DPA if it believes this other DPA is more suitable as the lead DPA. Such transfer needs to be conducted under supervision of the Presidency of the WP 29. Additional to the lead DPA and depending on the number of Member States from where the data is transferred, one co-reviewer (if less than 10 Member States) or 2 co-reviewers (if more than 10 Member States) will be appointed.

The review should be done in the context of a Mutual Recognition, and DPAs can freely decide on whether it wants to participate. The lead DPA will conduct the review and, once it is decided that the proposed contract conforms to the Model Clauses, it will send its conclusion in the form of a draft letter to the co-reviewer(s). The latter must submit their comments (if any) within a one-month deadline. If no comments are made within this timeframe, the draft letter, the analysis, and the draft contract will be sent to the other competent DPAs. Only those not participating in the Mutual Recognition procedure are allowed to make comments those documents. At a final stage, the lead DPA will sign the letter on behalf of all competent DPAs and will send it to the company.

Through this Working Document, the WP 29 is clearly choosing the path of harmonization, which is desirable to create uniformity and legal certainty within the EU.

Nevertheless, this procedure only relates to conformity to the EC Model Clauses. But when permits or authorizations are legally required, national DPAs may still analyze the annexes and descriptions of data transfers to assess their legality under national law. Moreover, in a situation where a company, after initially having intended to transfer data from a few Member States, decides to extend the geographical scope after the co-operation procedure, the additional competent DPAs are not bound by the decision made in the co-operation procedure. They are free to conduct their own analysis of the draft contract, but the company will have to bear the risk should the DPAs decide otherwise on the contract.

This article was written by student trainee Dorien Taeymans.

Click here to read a PDF version of the 51st edition of our ICT Law Newsletter. 

Team

Related news

08.11.2019 BE law
Interview with Wouter Ghijsels on Next Gen lawyers

Articles - Stibbe’s managing partner Wouter Ghijsels shares his insights on the next generation of lawyers and the future of the legal profession at the occasion of the Leaders Meeting Paris where Belgian business leaders, politicians and inspiring people from the cultural and academic world will discuss this year's central theme "The Next Gen".

Read more

13.11.2019 NL law
Een strategisch actieplan voor het gebruik van AI door de overheid

Short Reads - Een paar jaren geleden hoorde je er nog nauwelijks over, maar nu kan je er bijna niet meer om heen: kunstmatige intelligentie, ook wel artificiële intelligentie (AI) genoemd.  AI verwijst naar systemen die intelligent gedrag vertonen door hun omgeving te analyseren en – met een zekere mate van zelfstandigheid – actie ondernemen om specifieke doelen te bereiken. Denk aan zelfrijdende auto's of slimme thermostaten. 

Read more

08.11.2019 EU law
Erik Valgaeren is session chair during IBA's 6th Biennial Technology Law Conference in Berlin

Speaking slot - Stibbe's TMT partner, Erik Valgaeren, chairs a session discussing the new legal challenges, created by the most recent technological developments in the field of software, data, online services and telecom, including 5G, pricing algorithms, platforms and data monetization. This session will take place on the 8th of November 2019 in Berlin.

Read more

24.10.2019 BE law
Virtual Currency Regulation Law Review - Belgian chapter

Articles - The second edition of the Virtual Currency Regulation Law Review is intended to provide a practical, business-focused analysis of recent legal and regulatory changes and developments, and of their effects, and to look forward at expected trends in the area of virtual currencies on a country-by-country basis.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring