On March 21, 2014, the EU Article 29 Data Protection Working Party (''WP 29'') issued a working document (''WP 214'') proposing new contractual clauses for cross-border data transfers between an EU-based processor and a non-EU-based subprocessor (''Draft Model Clauses''). This document addresses the situation where personal data are initially transferred by a controller to a processor within the EU and then subsequently transferred by the processor to a subprocessor located outside the EU.
Back in 2010, the European Commission adopted a revised version of its model clauses for transfers between a controller in the EU and a processor outside the EU, partly to integrate new provisions on subprocessing (see analysis at WDPR, July 2010, page 32). However, it deliberately chose not to apply these new model clauses to situations whereby a processor established in the EU and performing the processing of personal data on behalf of a controller established in the EU subcontracts its processing operations to a subprocessor established in a third country.
Absent Binding Corporate Rules and the U.S-EU Safe Harbor Program, many EU data processors were left with few options for transferring data outside the EU. This issue is particularly relevant in the context of a growing digital economy where more and more companies are transferring their data to cloud computing service providers that are often based outside the EU. Negotiating ad hoc model clauses on a case-by-case basis with national data protection authorities (''DPAs'') seemed to be the only solution available.
Then, in 2012, Spain's DPA adopted a specific set of standard contractual clauses for processor-to-subprocessor transfers, and put in place a new procedure allowing data processors based in Spain to obtain authorizations for transferring data processed on behalf of their customers (data controllers) to subprocessors based outside the EU (see report at WDPR, December 2012, page 28).
The WP 29 was inspired to use the Spanish model as a basis for preparing draft ad hoc model clauses for transfers from an EU data processor to a non-EU subprocessor that could be used by any processor established in the EU.
While these Draft Model Clauses are most welcome, it remains to be seen whether the European Commission will formally adopt new model clauses for processors and how effective they will be in practice.
KEY PROVISIONS UNDER THE DRAFT MODEL CLAUSES
The Draft Model Clauses provide a new set of contractual clauses aimed at facilitating data transfers between an EU processor (acting on behalf of an EU controller) and a non-EU subprocessor.
The overall structure and content of these draft clauses are similar to those that already exist under the controller-to-processor model clauses, but they have been adapted to the context of transfers between a processor and a subprocessor.
Most of the clauses under the Draft Model...