Working Party ("WP 29") issued Working Document WP226. This document sets forth a co-operation procedure for issuing common opinions on contractual clauses that are considered compliant with the EC Model Clauses. Through this document the WP 29 wants to establish a more harmonized approach among the national data protection authorities ("DPAs") throughout the multiple jurisdictions of Europe in approving EU Model Clauses.
The Model Clauses were adopted by the European Commission to enable companies to put in place sufficient safeguards for legally framing international data transfers outside the EEA. In principle, companies choosing to use such clauses may not change them unless they seek prior approval from the DPA of the Member State from where the transfer is taking place ("competent DPA"). Nevertheless, it is possible for companies to draft a contract that contains additional (commercial) clauses alongside these Model Clauses as long as there is no direct or indirect contradiction between them.
In many Member States, a company must obtain an authorization from the DPA-before the data transfer-for both the use of an ad hoc contract and the use of Model Clauses. In a situation where the company wants to transfer data from different EU/EEA countries, this obligation entails the risk that the DPAs in the different Member States would not reach the same conclusion regarding the same draft contract.
Through this Working Document, the WP 29 launches a procedure that will enable companies to obtain a coordinated position of the different DPAs regarding their proposed contract. DPAs are free to decide, based on the circumstances, whether such co-operation procedure is opportune or not.
As a first step in the co-operation procedure, the company needs to choose a lead DPA out of the several competent DPAs. In the Working Document, the WP 29 sets out different possible decisive factors that can guide the company in the decision-making process. The chosen lead DPA has the possibility to transfer the application to another DPA if it believes this other DPA is more suitable as the lead DPA. Such transfer needs to be conducted under supervision of the Presidency of the WP 29. Additional to the lead DPA and depending on the number of Member States from where the data is transferred, one co-reviewer (if less than 10 Member States) or 2 co-reviewers (if more than 10 Member States) will be appointed.
The review should be done in the context of a Mutual Recognition, and DPAs can freely decide on whether it wants to participate. The lead DPA will conduct the review and, once it is decided that the proposed contract conforms to the Model Clauses, it will send its conclusion in the form of a draft letter to the co-reviewer(s). The latter must submit their comments (if any) within a one-month deadline. If no comments are made within this timeframe, the draft letter, the analysis, and the draft contract will be sent to the other competent DPAs. Only those not participating in the Mutual Recognition procedure are allowed to make comments those documents. At a final stage, the lead DPA will sign the letter on behalf of all competent DPAs and will send it to the company.
Through this Working Document, the WP 29 is clearly choosing the path of harmonization, which is desirable to create uniformity and legal certainty within the EU.
Nevertheless, this procedure only relates to conformity to the EC Model Clauses. But when permits or authorizations are legally required, national DPAs may still analyze the annexes and descriptions of data transfers to assess their legality under national law. Moreover, in a situation where a company, after initially having intended to transfer data from a few Member States, decides to extend the geographical scope after the co-operation procedure, the additional competent DPAs are not bound by the decision made in the co-operation procedure. They are free to conduct their own analysis of the draft contract, but the company will have to bear the risk should the DPAs decide otherwise on the contract.
