Ad hoc model clause slides from the IAPP KnowledgeNet on International Data Transfers held in Helsinki in March 2015.

1. 1 © Nokia 2015
DRAFT AD HOC CLAUSES
”EU data processor to non-EU sub-processor”
International Data Transfers - IAPP KnowledgeNet - Helsinki, Finland
• Oskari Rovamo, CIPP/E, Global Privacy Counsel, Nokia
• 25-03-2014
Public

2. 2 © Nokia 2015
• Article 29 WP Working Document – March 2014
- EU data processor to non-EU sub-processor (P2P)
• Need for P2P clauses?
• Overview of the P2P clauses
• Policy, legal and practical challenges
TODAY’S PRESENTATION
Public

3. 3 © Nokia 2015
NEED FOR P2P CLAUSES?
Existing Transfer Mechanisms
• Binding Corporate Rules
• Binding Corporate Rules for Processors
1,234
88
Safe Harbour Binding
Corporate
Rules (BCR)
• Controller – Controller (Set I & II)
• Controller – Processor (C2P)
Standard
Contractual
Clauses (SCC)
Public

4. 4 © Nokia 2015
Controller
Framework
Contract
EU
processor
(“exporter”)
Non-EU
sub-processor
(“importer”)
Subsequent
sub-processor
P2P - ENVISAGED CONTRACTUAL STRUCTURE
Public

5. 5 © Nokia 2015
Controller
• Content of the
Framework Contract is
stipulated in the P2P.
• Notifications to
supervisory authorities.
EU-Processor
• Must make P2P
”binding towards”
controller.
• Must comply with the
law applicable to the
controller.
Sub-Processor
• Must comply with the
Framework Contract.
• Must comply with the
law applicable to the
controller.
• Must comply with
instructions given to it
directly by the
controller.
KEY DIFFERENCES
C2P v P2P
Public

6. 6 © Nokia 2015
• Availability of the P2P depends on
Controller and Processor entering into
Framework Contract.
Contract Structure
• Why would Controller and Processor opt for a
more stringent regime?
• Why does the sub-processor need to comply
with an agreement that it is not a party to?
Frame Contract
POLICY CHALLENGES
Public

7. 7 © Nokia 2015
• Technical difficulties.
• Aims to bind all parties in the chain and
give them rights against each other.
Contract Structure
• Controller remains responsible and would
need to submit to DPAs contracts to which
it is not a party to.
Transfer
authorizations
• Sub-processors need to agree to apply the
law applicable to the controller.Compliance with laws
PRACTICAL & LEGAL CHALLENGES
Public

8. 8 © Nokia 2015
Multitenant data processing service – Main data processor
Sub-processor–
aspects of
processing
Sub-processor–
aspects of
processing
Sub-processor–
aspects of
processing
Controller Controller Controller Controller Controller Controller
Sub-processor–
aspects of sub-
processing Sub-processor–
aspects of sub-
processing
Sub-processor– aspects
of sub-processing– e.g.
Provides a multitenant
solution for data
processing
Sub-processor–
aspects of sub-
processing
Sub-processor–
aspects of sub-
processing
Sub-processor–
aspects of sub-
processing
Sub-processor–
aspects of
processing
Sub-processor–
aspects of
processing
CHALLENGES WITH P2P CLAUSES
Complex data flows
Public
How to manage the two
streams of documents
envisaged by the P2P
clauses?
Does a processor and a
sub-processor really
need to an expert on
the laws applicable to
the controllers?