![Default Article Featured Image_laptop-newspaper-global-article-090623[95].jpg](https://images.contentstack.io/v3/assets/bltd4dd5b2d705252bc/blt61f52659e86e1227/64ff207a8606a815d1c86182/laptop-newspaper-global-article-090623[95].jpg?width=3840&quality=75&format=pjpg&auto=webp)
The European Commission (EC) adopted
on 5 February, updating the standard contractual clauses for international transfers to data processors outside the EU/EEA (hereinafter: decision). The new model clauses incorporate information security requirements and sub-contracting and liability concerns by striking a balance between company concerns and the rights of data subjects.
The decision replaces the existing controller-to-processor model clauses provided in Decision 2002/16/EC. Companies with existing contracts in place using the “old model clauses” will remain in effect. However, if such companies and their data processors should decide to make modifications to previously agreed data processing contracts or decide to sub-contract the processing operations, then the amended contracts will need to comply with the newly issued model clauses (Art. 7). The decision does not relate to controller-to-controller agreements, which remain in effect and unchanged.
The new clauses require technical and organizational security measures to be applied by the data processors established in third countries. These measures should take into account existing data protection laws and balance the costs to companies in order to protect such data with security precautions. Here, the EC has attempted to strike a balance between data subjects’ rights and corporate concerns about implementation costs. The new model clauses also cover sub-processing to ensure that if the data processor subcontracts his processing duties, such subcontractors will ensure that the personal data continues to be protected (Clause 11).
Further, the updated model clauses stipulate that the data processor will remain liable for violations by sub-processors. This is complemented by third-party beneficiary rights granted to the data subjects to allow for their individual enforcement of the contract (Clause 3). This focus on individual rights is expanded by the data subject’s rights to make claims and pursue compensation from the data controller for any breach by the data processor or sub-processors of its obligations in case of bankruptcy or insolvency proceedings concerning the exporter (Clause 6).
