EU Addresses Data Processors In Non-EU Countries

Are boilerplate clauses the answer? The European Union ("EU") may soon be willing to guarantee compliance with the EU's stringent personal datatransfer regulations, so long as data processors are willing to use standard contractual clauses. However, data processors should have both eyes wide open before agreeing to the standard terms.

The EU is now reviewing Standard Contractual Clauses relating to personal data protections. Once approved, the Standard Clauses will be available to data processors located in countries, including the United States, where data protection policies do not "ensure an adequate level of protection" as required by EU Directive 95/46/EC

Under the EU Directive, Member States are only allowed to transfer personal data to non-EU countries if: 1) the countries' laws "ensure an adequate level of data protection," or 2) the parties transfer the data "subject to certain safeguards." The Directive states that "appropriate contractual clauses" may constitute an adequate safeguard. Since many countries outside the EU do not protect personal data at the level required by the EU, data processors in non-EU countries that engage in personal data transfers with companies in Member States may be required to rely on specific contractual clauses to comply with the Directive.

The EC's Standard Contractual Clauses aim to take the guesswork out of what constitutes an "appropriate contractual clause". Under the proposed legislation, Member States would be required "not to refuse to recognize" the Standard Contractual Clauses as providing adequate...