{"id":17902,"date":"2022-09-18T17:45:26","date_gmt":"2022-09-18T17:45:26","guid":{"rendered":"http:\/\/legalblog.ie\/?p=17902"},"modified":"2022-09-25T07:54:40","modified_gmt":"2022-09-25T07:54:40","slug":"data-out-of-eu","status":"publish","type":"post","link":"https:\/\/legalblog.ie\/data-out-of-eu\/","title":{"rendered":"Data Out of EU"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_63 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title \" >Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Transferring_Personal_Data_to_non-EU_countries\" title=\"Transferring Personal Data to non-EU countries:\">Transferring Personal Data to non-EU countries:<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Clause_1_Definitions\" title=\"Clause 1: Definitions\">Clause 1: Definitions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Clause_2_Transfer_details\" title=\"Clause 2: Transfer details\">Clause 2: Transfer details<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Clause_3_Third-party_beneficiary_clause\" title=\"Clause 3: Third-party beneficiary clause\">Clause 3: Third-party beneficiary clause<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Clause_4_Obligations_of_the_data_exporter\" title=\"Clause 4: Obligations of the data exporter\">Clause 4: Obligations of the data exporter<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Clause_5_Obligations_of_the_data_importer\" title=\"Clause 5: Obligations of the data importer\">Clause 5: Obligations of the data importer<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Clause_6_Liability\" title=\"Clause 6: Liability\">Clause 6: Liability<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Clause_7_Mediation_and_jurisdiction\" title=\"Clause 7: Mediation and jurisdiction\">Clause 7: Mediation and jurisdiction<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Clause_8_Cooperation_with_supervisory_authorities\" title=\"Clause 8: Cooperation with supervisory authorities\">Clause 8: Cooperation with supervisory authorities<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#Application_Background\" title=\"Application &amp; Background\">Application &amp; Background<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/legalblog.ie\/data-out-of-eu\/#MAIN_DOCUMENT\" title=\"MAIN DOCUMENT\">MAIN DOCUMENT<\/a><\/li><\/ul><\/nav><\/div>\n<h3><span class=\"ez-toc-section\" id=\"Transferring_Personal_Data_to_non-EU_countries\"><\/span>Transferring Personal Data to non-EU countries:<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Standard Contractual Clauses<\/p>\n<p>Decision 2010\/87\/EU on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95\/46\/EC<\/p>\n<p>It lays down standard contractual clauses which can be used by data controllers* (exporters) in the EU that transfer personal data* to data processors* (importers) established outside the EU or EEA, to provide appropriate data protection safeguards and thereby comply with the requirements of EU data protection laws (the general data protection regulation \u2014 Regulation (EU) 2016\/679 \u2014 see summary).<\/p>\n<p>The standard contractual clauses are set out in the annex to the decision as follows. Standard contractual clauses only relate to data protection and can be included by the parties in a wider contract or be supplemented with other clauses or additional safeguards, provided that they do not contradict, directly or indirectly, the standard contractual clauses adopted by this decision.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Clause_1_Definitions\"><\/span>Clause 1: Definitions<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Definitions of key notions used in the standard contractual clauses are set out.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Clause_2_Transfer_details\"><\/span>Clause 2: Transfer details<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The parties should list, in an annex to the contractual clauses, the details of the transfers, including the relevant activities of the data importer and exporter, the categories of personal data transferred and the processing operations to which the personal data will be subject once transferred.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Clause_3_Third-party_beneficiary_clause\"><\/span>Clause 3: Third-party beneficiary clause<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The clause allows data subjects to enforce several of the clauses against the data exporter, data importer or sub-processor as a third-party beneficiary. It furthermore provides that the parties do not object to a data subject being represented by an association or other body if permitted by national law.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Clause_4_Obligations_of_the_data_exporter\"><\/span>Clause 4: Obligations of the data exporter<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This clause lays down the contractual obligations for the data exporter, which has to agree and warrant to:<\/p>\n<p>process the personal data only in accordance with data protection law;<br \/>\ninstruct the data importer to process the data only on the data exporter\u2019s behalf and in accordance with data protection law and the clauses;<br \/>\nprovide (and comply with) sufficient guarantees in respect of technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, in particular where processing is over a network;<br \/>\ninform the data subject if special categories of data could be transmitted to a non-EU country with inadequate data protection;<br \/>\nforward the notification that it has received from the data importer about the latter\u2019s inability to comply with the clauses to the competent supervisory authority, if it decides to continue the transfer;<br \/>\nmake available to data subjects, upon request, a copy of the clauses, with a summary description of the security measures;<br \/>\nin the event of sub-processing, the sub-processor must provide at least the same level of personal data protection as the data importer.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Clause_5_Obligations_of_the_data_importer\"><\/span>Clause 5: Obligations of the data importer<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This clause lays down the contractual obligations of the data importer, which has to agree and warrant:<\/p>\n<p>to process the personal data only on behalf of the data exporter and in compliance with its instructions and the clauses;<br \/>\nthat it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract;<br \/>\nto promptly notify any change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the clauses, in which case the data exporter is entitled to suspend the transfer of data and\/or terminate the contract;<br \/>\nto implement specified technical and organisational security measures before processing the personal data transferred;<br \/>\nto promptly notify the data exporter about requests to disclose personal data by a law enforcement authority, any accidental or unauthorised access, and any request received directly from the data subjects without responding to the request, unless otherwise authorised;<br \/>\nto deal promptly with all inquiries from the data exporter and to abide by the advice of the supervisory authority;<br \/>\nat the request of the data exporter, to submit its data-processing facilities for audit of the processing activities covered by the clauses;<br \/>\nto make available to data subjects, upon request, a copy of the clauses, with a summary description of the security measures;<br \/>\nto hire a sub-processor only with prior written consent of the data exporter.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Clause_6_Liability\"><\/span>Clause 6: Liability<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The clauses require the parties to agree that any data subject who has suffered damages as a result of any breach of the obligations is entitled to receive compensation from the data exporter for the damages suffered.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Clause_7_Mediation_and_jurisdiction\"><\/span>Clause 7: Mediation and jurisdiction<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The data importer must agree that if the data subject invokes against it third-party beneficiary rights and\/or claims compensation for damages, it will accept the decision of the data subject to refer the dispute to independent mediation, or to the courts in the EU country in which the data exporter is established (with the right to seek remedies under other national or international laws).<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Clause_8_Cooperation_with_supervisory_authorities\"><\/span>Clause 8: Cooperation with supervisory authorities<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This clause governs the cooperation with the competent supervisory authority, by providing that:<\/p>\n<p>the supervisory authority has the right to conduct an audit of the data importer, and of any sub-processor;<br \/>\nthe data importer agrees to inform the data exporter about any legislation preventing an audit of the data importer. In such a case the data exporter shall be entitled to suspend data transfer or terminate the contract.<br \/>\nClause 9: Governing law<\/p>\n<p>The clauses should be governed by the national law of the EU country in which the data exporter is established.<\/p>\n<p>Clause 10: Variation of the contract<\/p>\n<p>The parties must not vary, modify or contradict the clauses.<\/p>\n<p>Clause 11: Sub-processing<\/p>\n<p>The provisions relating to sub-processing should be governed by the law of the EU country in which the data exporter is established.<\/p>\n<p>Clause 12: Obligation after the termination of personal data-processing services<\/p>\n<p>This clause regulates the obligations of the parties after termination of the data processing. In particular, the parties should agree that at the end of data-processing services, the data importer and the sub-processor must return (or destroy, on request) all the personal data transferred unless prevented from doing so by legislation.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Application_Background\"><\/span>Application &amp; Background<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It has applied since 15 May 2010.<\/p>\n<p>BACKGROUND<br \/>\nNote: this decision was the subject of a request for preliminary ruling that led to the Court of Justice of the EU judgment (Case C-311\/18) of 16 July 2020, in which the Court confirmed the validity of the decision.<br \/>\nThe European Commission has also issued 2 sets of standard contractual clauses for data transfers from data controllers in the EU to data controllers established outside the EU or EEA.<br \/>\nSee also:<br \/>\nData protection (European Commission).<\/p>\n<p>KEY TERMS<br \/>\nData controller: the natural or legal person, public authority, agency or other body which determines the purposes and means of the processing of personal data.<br \/>\nPersonal data: any information relating to a person (data subject) who can be identified, directly or indirectly, by a name, an identification number, location data, an online identifier or to factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.<br \/>\nData processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"MAIN_DOCUMENT\"><\/span>MAIN DOCUMENT<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Commission Decision 2010\/87\/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95\/46\/EC of the European Parliament and of the Council (OJ L 39, 12.2.2010, pp. 5-18)<\/p>\n<p>Successive amendments to Decision 2010\/87\/EU have been incorporated into the original text. This consolidated version is of documentary value only.<\/p>\n<p>RELATED DOCUMENTS<br \/>\nRegulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95\/46\/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, pp. 1-88)<\/p>\n<p>See consolidated version.<\/p>\n<p>Commission Decision 2004\/915\/EC of 27 December 2004 amending Decision 2001\/497\/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries (OJ L 385, 29.12.2004, pp. 74-84)<\/p>\n<p>Commission Decision 2001\/497\/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95\/46\/EC (OJ L 181, 4.7.2001, pp. 19-31)<\/p>\n<p>See consolidated version.<\/p>\n<p>Directive 95\/46\/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ L 281, 23.11.1995, pp. 31-50)<\/p>\n<!--themify_builder_content-->\n<div id=\"themify_builder_content-17902\" data-postid=\"17902\" class=\"themify_builder_content themify_builder_content-17902 themify_builder tf_clear\">\n    <\/div>\n<!--\/themify_builder_content-->\n","protected":false},"excerpt":{"rendered":"<p>Transferring Personal Data to non-EU countries: Standard Contractual Clauses Decision 2010\/87\/EU on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95\/46\/EC It lays down standard contractual clauses which can be used by data controllers* (exporters) in the EU that transfer personal data* to data processors* (importers) [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[123],"tags":[],"_links":{"self":[{"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/posts\/17902"}],"collection":[{"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/comments?post=17902"}],"version-history":[{"count":3,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/posts\/17902\/revisions"}],"predecessor-version":[{"id":17905,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/posts\/17902\/revisions\/17905"}],"wp:attachment":[{"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/media?parent=17902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/categories?post=17902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/legalblog.ie\/wp-json\/wp\/v2\/tags?post=17902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}