Privacy & Data Protection
Client Alert | 3 min read | 04.02.10
Other sections of this issue:
Privacy & Data Protection | ISP-Liability & Media Law | Contracts & E-Commerce |
Electronic Communications & IT
The European Commission has adopted on February 5, 2010, a Decision that updates the standard contractual clauses for the transfer of personal data to processors established outside the European Economic Area in countries that are not recognized as offering an 'adequate level of data protection'.
With respect to international transfers of personal data to countries outside of the European Economic Area, Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data provides that transfers to such third countries of personal data, which are undergoing processing or are intended for processing after transfer, may take place only if the third country ensures an "adequate level of protection".
However, where a third country does not ensure an adequate level of protection, under certain conditions, Member States may nevertheless authorize a transfer of personal data to that third country.
This is i.a. the case where the controller (who sends the personal data to the processor in the third country) adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights. Such safeguards may in particular result from the use of appropriate contractual clauses in the contract entered into between the controller and the processor .
In that respect, Directive 95/46/EC provides that the European Commission may decide that certain standard contractual clauses offer sufficient safeguards for transfers of personal data to a third country that does not offer an adequate level of protection.
The European Commission did so with respect to the so-called "controller to processor" standard contractual clauses, which were approved by Commission Decision 2002/16/EC.
These standard contractual provisions allow companies to comply with the obligation to ensure "adequate protection" for personal data when it is transferred to processors outside the European Economic Area who are located in countries that do not ensure an adequate level of protection. Indeed, these standard contractual clauses are automatically considered as offering adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of the individuals concerned.
The February 5, 2010, Decision of the European Commission, has modified the standard contractual clauses to be applied in case of a transfer of personal data from the controller to the processor. It has done so in order to take into account the expansion of processing activities and new business models for international processing of personal data. The new text contains specific provision to allow, under certain conditions, the outsourcing of processing activities by the processor in the third country to "sub-processors", while ensuring a constant protection of personal data. It inter alia provides for specific rules on which entity (controller / processor / sub-processor) can be held liable in case a data subject has suffered damage as a consequence of a violation of privacy and data protection obligations.
Links:
The new standard contractual clauses can be found at: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:EN:PDF
For more information, contact: Frederik Van Remoortel.
Contacts
Insights
Client Alert | 5 min read | 12.12.25
Eleventh Circuit Hears Argument on False Claims Act Qui Tam Constitutionality
On the morning of December 12, 2025, the Eleventh Circuit heard argument in United States ex rel. Zafirov v. Florida Medical Associates, LLC, et al., No. 24-13581 (11th Cir. 2025). This case concerns the constitutionality of the False Claims Act (FCA) qui tam provisions and a groundbreaking September 2024 opinion in which the United States District Court for the Middle District of Florida held that the FCA’s qui tam provisions were unconstitutional under Article II. See United States ex rel. Zafirov v. Fla. Med. Assocs., LLC, 751 F. Supp. 3d 1293 (M.D. Fla. 2024). That decision, penned by District Judge Kathryn Kimball Mizelle, was the first success story for a legal theory that has been gaining steam ever since Justices Thomas, Barrett, and Kavanaugh indicated they would be willing to consider arguments about the constitutionality of the qui tam provisions in U.S. ex rel. Polansky v. Exec. Health Res., 599 U.S. 419 (2023). In her opinion, Judge Mizelle held (1) qui tam relators are officers of the U.S. who must be appointed under the Appointments Clause; and (2) historical practice treating qui tam and similar relators as less than “officers” for constitutional purposes was not enough to save the qui tam provisions from the fundamental Article II infirmity the court identified. That ruling was appealed and, after full briefing, including by the government and a bevy of amici, the litigants stepped up to the plate this morning for oral argument.
Client Alert | 8 min read | 12.11.25
Director Squires Revamps the Workings of the U.S. Patent Office
Client Alert | 8 min read | 12.10.25
Creativity You Can Use: CJEU Clarifies Copyright for Applied Art
Client Alert | 4 min read | 12.10.25
Federal Court Strikes Down Interior Order Suspending Wind Energy Development
