Commission Decision of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC (notified under document number C(2001) 1539) (Text with EEA relevance) (2001/497/EC)

• Celex Number: 02001D0497-20161217
• Coming into Force: 17 December 2016
• Published date: 17 December 2016
• ELI: http://data.europa.eu/eli/dec/2001/497/2016-12-17
• Date: 17 December 2016
• Court: Provisional data

02001D0497 — EN — 17.12.2016 — 002.001

---

This text is meant purely as a documentation tool and has no legal effect. The Union's institutions do not assume any liability for its contents. The authentic versions of the relevant acts, including their preambles, are those published in the Official Journal of the European Union and available in EUR-Lex. Those official texts are directly accessible through the links embedded in this document

►B COMMISSION DECISION of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC (notified under document number C(2001) 1539) (Text with EEA relevance) (2001/497/EC) (OJ L 181 4.7.2001, p. 19)

Amended by:

		Official Journal
		No	page	date
►M1	COMMISSION DECISION 2004/915/EC of 27 December 2004	L 385	74	29.12.2004
►M2	COMMISSION IMPLEMENTING DECISION (EU) 2016/2297 Text with EEA relevance of 16 December 2016	L 344	100	17.12.2016

Corrected by:

►C1 Corrigendum, OJ L 253, 21.9.2001, p. 34 (2001/497/EC)

---

▼B

COMMISSION DECISION

of 15 June 2001

on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC

(notified under document number C(2001) 1539)

(Text with EEA relevance)

(2001/497/EC)

Article 1

The standard contractual clauses set out in the Annex are considered as offering adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights as required by Article 26(2) of Directive 9/46/EC.

▼M1

Data controllers may choose either of the sets I or II in the Annex. However, they may not amend the clauses nor combine individual clauses or the sets.

▼B

Article 2

This Decision concerns only the adequacy of protection provided by the standard contractual clauses for the transfer of personal data set out in the Annex. It does not affect the application of other national provisions implementing Directive 95/46/EC that pertain to the processing of personal data within the Member States.

This Decision shall not apply to the transfer of personal data by controllers established in the Community to recipients established outside the territory of the Community who act only as processors.

Article 3

For the purposes of this Decision:

(a)the definitions in Directive 95/46/EC shall apply;

(b)‘special categories of data’ means the data referred to in Article 8 of that Directive;

(c)‘supervisory authority’ means the authority referred to in Article 28 of that Directive;

(d)‘data exporter’ means the controller who transfers the personal data;

(e)‘data importer’ means the controller who agrees to receive from the data exporter personal data for further processing in accordance with the terms of this Decision.

▼M2

Article 4

Whenever the competent authorities in Member States exercise their powers pursuant to Article 28(3) of Directive 95/46/EC leading to the suspension or definitive ban of data flows to third countries in order to protect individuals with regard to the processing of their personal data, the Member State concerned shall, without delay, inform the Commission, which will forward the information to the other Member States.

▼B

Article 5

►M1 The Commission shall evaluate the operation of this Decision on the basis of available information three years after its notification and the notification of any amendment thereto to the Member States. ◄ It shall submit a report on the endings to the Committee established under Article 31 of Directive 95/46/EC. It shall include any evidence that could affect the evaluation concerning the adequacy of the standard contractual clauses in the Annex and any evidence that this Decision is being applied in a discriminatory way.

Article 6

This Decision shall apply from 3 September 2001.

Article 7

This Decision is addressed to the Member States.

---

ANNEX

▼M1

SET I

▼B

[Image only available in PDF version]

[Image only available in PDF version]

[Image only available in PDF version]

►(1) C1

[Image only available in PDF version]

Appendix 1

to the standard contractual clauses

[Image only available in PDF version]

[Image only available in PDF version]

Appendix 2

to the standard contractual clauses

Mandatory data protection principles referred to in the first paragraph of Clause 5(b)

These data protection principles should be read and interpreted in the light of the provisions (principles and relevant exceptions) of Directive 95/46/EC.

They shall apply subject to the mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others.

1.Purpose limitation: data must be processed and subsequently used or further communicated only for the specific purposes in Appendix I to the Clauses. Data must not be kept longer than necessary for the purposes for which they are transferred.

2.Data quality and proportionality: data must be accurate and, where necessary, kept up to date. The data must be adequate, relevant and not excessive in relation to the purposes for which they are transferred and further processed.

3.Transparency: data subjects must be provided with information as to the purposes of the processing and the identity of the data controller in the third country, and other information insofar as this is necessary to ensure fair processing, unless such information has already been given by the data exporter.

4.Security and confidentiality: technical and organisational security measures must be taken by the data controller that are appropriate to the risks, such as unauthorised access, presented by the processing. Any person acting under the authority of the data controller, including a processor, must not process the data except on instructions from the controller.

5.Rights of access, rectification, erasure and blocking of data: as provided for in Article 12 of Directive 95/46/EC, the data subject must have a right of access to all data relating to him that are processed and, as appropriate, the right to the rectification, erasure or blocking of data the processing of which does not comply with the principles set out in this Appendix, in particular because the data are incomplete or inaccurate. He should also be able to object to the processing of the data relating to him on compelling legitimate grounds relating to his particular situation.

6.Restrictions on onwards transfers: further transfers of personal data from the data importer to another controller established in a third country not providing adequate protection or not covered by a decision adopted by the Commission pursuant to Article 25(6) of Directive 95/46/EC (onward transfer) may take place only if either:

(a)data subjects have, in the case of special categories of data, given their unambiguous consent to the onward transfer or, in other cases, have been given the opportunity to object.

The minimum information to be provided to data subjects must contain in a language understandable to them:

—the purposes of the onward transfer,

—the identification of the data exporter established in the Community,

—the categories of further recipients of the data and the countries of destination, and

—an explanation that, after the onward transfer, the data may be processed by a controller established in a country where there is not an adequate level of protection of the privacy of individuals; or

(b)the data exporter and the data importer agree to the adherence to the Clauses of another controller which thereby becomes a party to the Clauses and assumes the same obligations as the data importer.

7.Special categories of data: where data revealing racial or ehtnic origin, political opinions, religious or philosophical beliefs or trade union memberships and data concerning health or sex life and data relating to offences, criminal convictions or security measures are processed, additional safeguards should be in place within the meaning of Directive 95/46/EC, in particular, appropriate security measures such as strong encryption for transmission or such as keeping a record of access to sensitive data.

8.Direct marketing: where data are processed for the purposes of direct marketing, effective procedures should exist allowing the data subject at any time to ‘opt-out’ from having his data used for such purposes.

9.Automated individual decisions: data subjects are entitled not to be subject to a decision which is based soley on automated processing of data, unless other measures are taken to safeguard the individual's legitimate interests as provided for in Article 15(2) of Directive 95/46/EC. Where the purpose of the transfer is the taking of an automated decision as referred to in Article 15 of Directive 95/46/EC, which produces legal effects concerning the individual or significantly affects him and which is based solely on automated processing of data intended to evaluate certain personal aspects relating to him, such as his performance at work, creditworthiness, reliability, conduct, etc., the individual should have the right to know the reasoning for this decision.

Appendix 3

to the standard contractual...