Article 29 Working Party Issues Draft Model Clauses: EU Data Processor to Non-EEA Sub-processor.

The Article 29 Working Party has recently issued a working document on draft model clauses for the transfer of personal data between an EU-based data processor and a non-EEA based data sub-processor.

The Commission has previously approved model clauses governing controller-to-controller and controller-to-processor transfers, but has not yet approved any model clauses that would allow an EU-based data processor sub-contract its processing activity to a non-EEA based sub-processor. Therefore, as an increasingly greater number of data processors choose to sub-contract their processing activities outside the EEA, they have little option but to negotiate ad-hoc arrangements with sub-processors. This practice is far from ideal as there is always a danger that the relevant data protection authority may deem the contract to be inadequate.

If adopted in their current state, the draft model clauses would provide a high level of transparency and accountability to this type of data transfer. Their adoption would also ensure legal certainty, through a pre-approved set of clauses.

It remains to be seen whether the Commission will formally adopt these clauses and in the interim the clauses cannot be relied upon. Due to the growing trend of companies using cloud based service providers, many of which are based outside the EEA, a clarification of the applicable rules is necessary sooner rather than later.