During the Article 29 Working Party’s meeting of November 26, the national data protection authorities (DPAs) of the 28 EU member states agreed on a new “Co-Operation Procedure for Issuing Common Opinions on Contractual Clauses” considered as compliant with the EC Model Clauses.

The new cooperation procedure, adopted through a working document, aims to help companies that want to rely on the model contracts to export personal information from the European Economic Area (EEA) but where small amendments are made to these model contracts. In practice, this may lead to different treatment between EEA countries, where minimal divergences from the official model contracts may or may not trigger “prior checking” of the DPAs. The newly introduced cooperation procedure allows companies to obtain a coordinated decision of the competent DPAs as to whether the proposed data transfer agreement can be treated as a model contract.

Procedure

The Article 29 Working Party appears to have taken inspiration for the development of the co-operation procedure from the procedure which currently exists for the approval of binding corporate rules (BCRs).

1. First Step: Addressing Lead DPA

Similar to the BCRs’ approval procedure, a company that wants to obtain confirmation that its proposed data transfer agreement is in conformity with the model contracts should send a copy of the draft agreement in electronic format indicating the divergences with the model contracts and a list of the EEA jurisdictions of export to the DPA which it considers to be acting as “lead” DPA.

The lead DPA should be selected from the competent DPAs; i.e., DPAs of data exporting EEA jurisdictions, on the basis of predetermined criteria set forth in the working document and which show similarity of the criteria used to indicate a lead for the handling of a BCR application, e.g., the EU member state from which most data transfers outside the EEA take place. Within two weeks of receiving an application, the DPA should decide whether to start a cooperation procedure or not and whether it wants to forward the application to a different DPA. If it accepts to act as lead DPA, it will forward the application package to the other competent DPAs, which then have two weeks to oppose the designation of the lead DPA.

2. Second Step: Review

The lead DPA will make a first assessment of the draft data transfer agreement and may propose amendments. If the applicant and the lead DPA have reached a consensus, the draft data transfer agreement and the DPA’s findings and recommendations, in the form of a draft letter, will be forwarded to the co-reviewer(s). If the draft transfer agreement is to be used in fewer than 10 countries, there will be one co-reviewer appointed. In all other cases, there will be two co-reviewers. It is important for companies to determine the relevant jurisdictions of data export, since DPAs will only be bound by the lead DPA’s and the co-reviewers’ position if they have been involved in the cooperation procedure. After the review of the draft letter and proposed data transfer agreement by the co-reviewers, which should be conducted within one month, the documents are forwarded to the other competent DPAs.   

Similar to the BCR approval process, the DPAs have set up a voluntary mutual recognition process. DPAs that are part of the mutual recognition process will accept and follow the decision of the lead DPA and co-reviewer(s) without any further assessment. DPAs that are not part of the mutual recognition process can provide their comments to the draft letter with the conformity decision, proposed data transfer agreement and analysis within one month.

3. Final Step: Obtaining National Authorization or Permits

At the end of the review process, the lead DPA will sign and send, on behalf of all the relevant DPAs, the conformity decision to the applicant. If the decision indicates that the draft data transfer agreement is compliant with the model contract, the cooperation procedure is closed and the applicant may trust that the agreement will be handled by the relevant DPAs as a model contract, which is exempt of data transfer permits in many but not all EEA jurisdictions.

Conclusion

The procedure adopted by the Article 29 Working Party recognizes the need for a truly harmonized approach to handling data-transfer agreements throughout the EEA. Consistent approaches will become even more important under the future General Data Protection Regulation, which exempts model contracts from prior DPA authorization. Multinationals will want to obtain certainty that small amendments to model contracts do not automatically disqualify them from these exemptions.