Reinier advises national and international companies
reinier.russell@russell.nl +31 20 301 55 55Does your company save personal data of EU citizens outside the EU? In that case you also have to comply with the European privacy regulation, the GDPR. Even if somebody else processes the data for you. How do you arrange this?
There are three ways in which you can comply with the General Data Protection Regulation (GDPR) when processing data outside the EU, i.e.:
A variant of option 3 is the EU-US Privacy Shield. The USA as a whole do not offer an adequate level of data protection. Companies and organisations in the USA can be certified if they comply with the framework of the Privacy Shield and can have this recorded with the US Department of Commerce. European companies can have these registered companies process data of EU citizens. However, this Privacy Shield has been invalidated, which also had consequences for the use of the standard contractual clauses.
To resolve this, the European Commission has taken two measures. Firstly, the standard contractual clauses have been amended, so that they can be used again. In addition, the EU and the US are providing a supplementary arrangement for the Privacy Shield, the Trans-Atlantic Data Privacy Framework.
To help you make arrangements with your processor outside the EU, the EU has drawn up standard contractual clauses you can use for this purpose. After the Privacy Shield was declared invalid, these standard contractual clauses were tightened. The new clauses can be found here in English.
Please note: If your processor has data of EU citizens processed outside the EU by another processor outside the EU, their agreement must provide the same level of protection. So even if both parties to the processing agreement are established outside the EU, it might be necessary to make use of the standard contractual clauses. Make sure your processor knows this!
The parties are not required to use the standard contractual clauses but they will have to lay down at least the same level of protection as guaranteed by the standard contractual clauses in an agreement. This will not be easy.
The standard contractual clauses are meant for different types of agreements. Please note: The standard contractual clauses are available in modules and in various implementing acts. Moreover, various options can be chosen within the standard clauses. Good legal advice is therefore very important.
Words are just words. So the clauses as such do not say everything. Especially, if binding legislation in the country of the processor clashes with the standard clauses there will be a problem. In that case, it must be agreed how the processor can safeguard that its own government will not get access to the data of EU citizens if the government does not have a ground under the GDPR. This was the case with the processing of personal data in the United States. Therefore, the EU-US Privacy Shield was declared invalid.
This, however, does also have consequences for the use of the standard contractual clauses. After all, it is difficult for companies in the USA to give safeguards about the behaviour of the US security services. That is why the EU and the USA are working on a new scheme: the Trans-Atlantic Data Privacy Framework. What will it include?
According to a declaration of the White House, in this arrangement, the USA undertakes to:
According to the EU, this will comply with the GDPR. In the coming period, these objectives will be elaborated in legal regulations.
The Trans-Atlantic Data Privacy Framework will not substitute the Privacy Shield but is complementary to it. The system of the Privacy Shield remains intact. However, the Privacy Shield will only become relevant again if the TADP enters into force. Until then, you can make use of the new standard contractual clauses in contracts with processors in the US. If it involves processing by another part of your organisation, you can make use of the binding corporate rules.
And no doubt the question whether the TADP does comply with the GDPR will also be brought before the European Court.
Do you have any questions about standard contractual clauses or do you want us to draft binding corporate rules? Do you have any other questions concerning privacy and the processing of personal data? Please contact us:
Almost all companies now use some form of AI. This means that they may be subject to the prohibitions and regulations set out in the European AI Act. How can you ensure that you comply with these rules?
An earn-out in the event of a company takeover offers opportunities and risks. The former director and major shareholder remains involved in the company and part of the purchase price remains dependent on future performance. What aspects are important here?
In principle, a continuing performance agreement can always be terminated, even if no arrangements have been made in this regard. But you can’t just do it. What do you need to take into account when terminating the agreement? And what if you want to deviate from the arrangements made about terminating the agreement?
On 28 June 2025, the European Accessibility Act will come into force. From that data, digital products and services must also be accessible to people with disabilities. Which companies, products and services does the Act apply to? What disabilities should you take into account? What are the consequences of not complying with the Act?
If a contract has ended, there may still be obligations you want your contract partner to fulfil, such as warranties or confidentiality. You can regulate this through survival clauses. What should you look out for when including such clauses?
The franchise agreement and the distribution agreement are very similar, but there are also important differences. What are the consequences if you conclude a franchise agreement when it is actually a distribution agreement or vice versa? How can you avoid this misunderstanding?
