On November 26, 2014, the Article 29 Working Party adopted a working document setting out a cooperation procedure for issuing common opinions on contractual clauses considered as compliant with the EC Model Clauses (the “Working Document”).  The Working Document sets out the framework for a procedure designed to streamline the process of obtaining the necessary approvals to transfer data outside the EEA.  It introduces the concept of a “Lead DPA,” through whom an applicant company would be able to deal with a range of competent national authorities in order to gain a common opinion on the adequacy of its contractual clauses.

The publication of this Working Document serves as an indication that European data protection authorities recognize that the current system is burdensome and often time-consuming for companies seeking to transfer data outside the EEA.  However, it remains to be seen when, or even if, the procedure proposed by the Working Party will be put into practice.

Obtaining a common opinion

The proposed scheme would rely partly on a voluntary “Mutual Recognition” system, similar to that in place for BCRs.  It is designed to apply in circumstances where a company’s contract is based primarily on the EC Model Clauses.  Where this is the case, an applicant company would, using criteria set out in the Working Document, be able to identify a competent authority to act as “Lead DPA”.  This authority would then assess whether the application is appropriate and, if so, forward the information to authorities in each country where data transfers will take place.  Depending on the scope of the proposed data transfers, one or more of these DPAs would act as reviewers of the contract.  The Lead DPA would be primarily responsible for analyzing the company’s contract for compliance with the Model Clauses, and the additional reviewer(s) would be charged with reviewing the Lead DPA’s analysis and, where appropriate, providing comments.

Where both the Lead DPA and any additional reviewers are satisfied that the contract meets the standards of the Model Clauses, the contract, together with their analysis, would be sent to all relevant competent national authorities.  Those that have subscribed to the Mutual Recognition system would be deemed to be similarly satisfied, whilst those that have not would have a one-month window in which to submit comments.  Provided that this stage is cleared, the Lead DPA would then, on behalf of the other competent DPAs, send a letter to the company, indicating that the contract meets the standards of the Model Clauses.

The effect of a favourable common opinion 

Even where a contract has obtained a favourable common opinion through the cooperation procedure, an applicant company will still be required to obtain the necessary permits or authorizations from competent DPAs.  However, the Working Document makes clear that a positive result of the cooperation procedure will be taken into consideration by national authorities when deciding whether to authorize an overseas data transfer.

This article was written with contributions from Tom Jackson, a trainee solicitor in Covington’s London office.