February 1, 2005
On January 7, 2005, pursuant to Decision C(2004)5271, the European Commission put its seal of approval on a new set of standard clauses (the "New Clauses") that can be used by companies wishing to export personally-identifiable data ("Personal Data") from the European Union ("EU") to third-party countries that do not otherwise provide "adequate" protection to Personal Data. The New Clauses represent one more mechanism upon which companies can rely when seeking to transfer Personal Data outside of the EU in accordance with the requirements of Directive 95/46/EC and the applicable national implementing legislation.
The New Clauses Represent an Additional, More Business-Friendly Solution for Legitimizing Personal Data Transfers
Prior to the acceptance of the New Clauses, U.S. companies had a limited number of compliance options, including, without limitation, entering into agreements that incorporate the previously approved standard contractual clauses, participating in the Safe Harbors program negotiated between EU authorities and the U.S. Department of Commerce and relying on certain limited exceptions to the general restrictions applicable to cross-border Personal Data flows. The use of these compliance options is not necessary where Personal Data is being transferred to countries that have been deemed to provide an "adequate" level of protection. However, the list of countries that provide "adequate" protection is quite limited and, at present, only includes Switzerland, Canada, Argentina and the UK territories of Guernsey and the Isle of Man (as well as U.S. companies participating in "Safe Harbors").
The New Clauses were submitted by a business coalition led by the International Chamber of Commerce and are intended to be more cognizant of business realities than the standard contractual clauses previously approved by the European Commission. In particular, clauses concerning litigation, allocation of responsibility and auditing requirements are said to be more "business friendly" than the previous clauses. In effort to prevent abuse, however, under the New Clauses, data protection authorities will have greater powers to intervene and impose sanctions where necessary. The European Commission is scheduled to review the implementation of the New Clauses in 2008.
It is important to note that the New Clauses do not supercede the standard contractual clauses previously approved by the Commission and currently used by many companies. The New Clauses and the previously approved clauses are both valid and companies will have the ability to choose which clauses best meet their needs. Companies seeking a more business-friendly approach for legitimizing crossborder Personal Data transfers may wish to consider the New Clauses.
Goodwin Procter LLP is one of the nation's leading law firms, with a team of 650 attorneys and offices in Boston, New York and Washington, D.C. The firm combines in-depth legal knowledge with practical business experience to deliver innovative solutions to complex legal problems. We provide litigation, corporate law and real estate services to clients ranging from start-up companies to Fortune 500 multinationals, with a focus on matters involving private equity, technology companies, real estate capital markets, financial services, intellectual property and products liability.
This article, which may be considered advertising under the ethical rules of certain jurisdictions, is provided with the understanding that it does not constitute the rendering of legal advice or other professional advice by Goodwin Procter LLP or its attorneys. (c) 2005 Goodwin Procter LLP. All rights reserved.