EU commission standard contractual clauses

The provided text appears to be an excerpt from the European Commission's Standard Contractual Clauses (SCCs) for the transfer of personal data from a data controller in the European Union (EU) to a data controller in a third country. These SCCs are designed to ensure that the transfer of personal data complies with the requirements of the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

Here is a breakdown of the key points in this excerpt:

1. **Clause 1 - Purpose and Scope**: This clause establishes the purpose of the standard contractual clauses, which is to ensure compliance with the GDPR when transferring personal data to a third country. It defines the parties involved, including the data exporter and data importer, and specifies that the clauses apply to the transfer of personal data as outlined in Annex I.B.

2. **Clause 2 - Effect and Invariability of the Clauses**: This clause highlights that the SCCs provide safeguards for data protection and should not be modified unless to select the appropriate module or to add/update information in the Appendix. It allows for these SCCs to be included in a broader contract but prohibits any modifications that contradict the SCCs or infringe on data subject rights.

3. **Clause 3 - Third-party Beneficiaries**: Data subjects are given the right to invoke and enforce these SCCs as third-party beneficiaries against the data exporter and data importer, with some exceptions listed. This clause does not affect data subjects' rights under the GDPR.

4. **Clause 4 - Interpretation**: Defines how terms are interpreted in relation to the GDPR and specifies that these SCCs should not conflict with GDPR rights and obligations.

5. **Clause 5 - Hierarchy**: In case of conflicts between these SCCs and related agreements between the parties, the SCCs take precedence.

6. **Clause 6 - Description of the Transfer(s)**: Details of the transfer, including the categories of personal data and the purpose of the transfer, are specified in Annex I.B.

7. **Clause 7 - Docking Clause (Optional)**: Allows other entities not initially part of the agreement to join these SCCs by completing the required documentation.

8. **Section II - Obligations of the Parties**: This section outlines the obligations that both the data exporter and data importer must adhere to when transferring and processing personal data.

- **Clause 8 - Data Protection Safeguards**: Specifies various safeguards related to data processing, including purpose limitation, transparency, accuracy, data minimization, storage limitation, and security of processing.

- **Clause 8.7 - Onward Transfers**: Details the conditions under which onward transfers of personal data to third parties may occur, including the requirement that the third party provides appropriate data protection safeguards.

- **Clause 8.9 - Documentation and Compliance**: Mandates that both parties maintain documentation of their data processing activities and make this documentation available to the competent supervisory authority upon request.

These SCCs are a critical part of ensuring the lawful and secure transfer of personal data from the EU to third countries while maintaining the protection of data subjects' rights as required by the GDPR. Parties involved in such data transfers must carefully adhere to these clauses to ensure compliance with EU data protection laws.

This is a continuation of the European Commission's Standard Contractual Clauses (SCCs) for the transfer of personal data from a data controller in the European Union (EU) to a data controller in a third country. The provided text covers various aspects of data protection, including data subject rights, liability, and supervision. Here is a breakdown of the clauses:

**Clause 10 - Data Subject Rights**: This clause addresses the rights of data subjects (the individuals whose data is being processed) and the obligations of the data importer regarding these rights. Key points include:

- The data importer must respond to data subject inquiries and requests related to the processing of their personal data within one month.

- Data subjects have the right to access their personal data, receive a copy of their data, and obtain information about onward data transfers.

- Data subjects can request the rectification of inaccurate or incomplete data and the erasure of their data under certain conditions.

- The data importer must cease processing data for direct marketing purposes if a data subject objects.

- Automated decisions (decisions made solely by automated means without human intervention) should not be made without explicit consent or unless authorized by local laws, with provisions for safeguards and information provision to the data subject.

- If data subject requests are excessive, the data importer may charge a reasonable fee or refuse to act on the request under certain conditions.

**Clause 11 - Redress**: This clause addresses how data subjects can seek redress if they have concerns about data processing. Key points include:

- The data importer must inform data subjects of a contact point for complaints.

- Disputes between data subjects and the parties should be resolved amicably.

- Data subjects can lodge complaints with supervisory authorities or refer disputes to competent courts. They can be represented by not-for-profit bodies, organizations, or associations.

- The data importer agrees to abide by decisions made under applicable EU or Member State law.

- Data subjects' rights to seek remedies under applicable laws are not prejudiced by this clause.

**Clause 12 - Liability**: This clause addresses liability for breaches of the SCCs. Key points include:

- Each party is liable to the other for damages caused by breaches of the SCCs.

- Parties are also liable to data subjects for damages resulting from breaches of third-party beneficiary rights under the SCCs.

- If multiple parties are responsible for damages, they are jointly and severally liable.

- The responsible party can claim back part of the compensation from other parties based on their responsibility for the damage.

- The data importer cannot use the conduct of a processor or sub-processor to avoid liability.

**Clause 13 - Supervision**: This clause discusses the role of the supervisory authority in ensuring compliance with the SCCs. Key points include:

- The supervisory authority responsible for ensuring data exporter compliance with EU Regulation (EU) 2016/679 (GDPR) is the competent supervisory authority.

- The data importer agrees to cooperate with and submit to the jurisdiction of the competent supervisory authority, including responding to inquiries, audits, and measures imposed by the authority to ensure compliance.

The text continues with "Section III – Local laws and obligations in case of access by public authorities," but the provided excerpt does not cover this section. This section typically addresses how the parties will respond to legal requests or demands for access to personal data by public authorities in the data importer's jurisdiction. It establishes procedures and requirements to protect data subjects' rights and comply with applicable laws in such situations.

The text you provided appears to be a set of clauses and annexes related to data protection and data transfer between parties involved in processing personal data, such as data exporters and data importers. These clauses and annexes are designed to ensure that the transfer of personal data complies with data protection regulations and safeguards the rights and privacy of data subjects. Below is a summary of the key points from the text:

**Clauses**:

**8.1 Purpose Limitation**: The data importer can only process personal data for the specific purpose(s) for which it was transferred. Exceptions include obtaining consent from the data subject, legal defense, or protecting vital interests.

**8.2 Transparency**: Data importers must inform data subjects about their identity, the types of personal data processed, and the right to obtain a copy of these clauses. They must also inform data subjects about onward transfers of their data.

**8.3 Accuracy and Data Minimization**: Both parties must ensure that personal data is accurate, up-to-date, and limited to what is necessary for the intended purpose.

**8.4 Storage Limitation**: Data importers must retain personal data only for as long as necessary for the specified purpose and implement measures for erasure or anonymization at the end of the retention period.

**8.5 Security of Processing**: Both parties must implement technical and organizational measures to ensure the security of personal data and address personal data breaches promptly.

**8.6 Sensitive Data**: Additional safeguards and restrictions apply when transferring sensitive data.

**8.7 Onward Transfers**: Personal data can only be transferred to third parties under specific conditions, including obtaining consent or ensuring adequate data protection safeguards.

**8.8 Processing under the Authority of the Data Importer**: Any person processing data must do so only under the instructions of the data importer.

**8.9 Documentation and Compliance**: Both parties must demonstrate compliance with these clauses, and the data importer must make relevant documentation available to the competent supervisory authority.

**Clause 10 Data Subject Rights**: The data importer must address data subject inquiries and requests regarding their rights under these clauses, including providing information, rectification, erasure, and addressing automated decisions.

**Clause 11 Redress**: Procedures for handling complaints and disputes, including the involvement of supervisory authorities and third-party bodies representing data subjects.

**Clause 12 Liability**: Allocation of liability between the parties for any damages caused by breaches of these clauses.

**Clause 13 Supervision**: Identifies the competent supervisory authority responsible for ensuring compliance.

**Clause 14 Local Laws and Practices**: Parties warrant that local laws and practices in the destination country do not prevent compliance with these clauses. They must assess and document these conditions.

**Clause 15 Obligations in Case of Access by Public Authorities**: Specifies notification and legal review requirements if public authorities request access to transferred data.

**Clause 16 Non-compliance and Termination**: Procedures for suspending data transfers and terminating the contract in cases of non-compliance with these clauses.

**Clause 17 Governing Law**: The governing law for these clauses is Luxembourg law.

**Clause 18 Choice of Forum and Jurisdiction**: Specifies the choice of forum and jurisdiction for resolving disputes related to these clauses.

**Annex I**: Provides details about the parties involved, categories of data subjects, types of personal data transferred, and the purpose of data transfer.

**Annex II**: Lists technical and organizational measures to ensure data security, such as firewall, encryption, access controls, and incident response.

These clauses and annexes are designed to establish a legal framework for the international transfer of personal data while ensuring that the data remains protected in accordance with data protection regulations. It's important for the parties involved to comply with these clauses to protect the rights and privacy of data subjects.