EU Member States Urged to Improve Data Transfer Notification Practice

Date: Sep 30, 2003

In its note of August 21, 2003, DG Internal Market of the European Commission urged the EU Member States to improve in notifying the Commission of foreign data transfers pursuant to Article 26 (3) of the Data Protection Directive, Directive 95/46/EC. Given the increasingly broad use of enterprise management databases for HR, consumer and business databases, often with servers and databases located outside the EU, this note presages an emerging focus on this aspect of the Data Directive, so businesses should make sure they are complying with national implementing legislation regarding notifications if they are transferring data outside the EU. Article 26 (3) requires the EU Member States to notify the Commission of authorizations granted for data transfers to countries "lacking adequate level of personal data protection" (in effect, most countries) on the basis of the derogation provided under Article 26 (2) of the Directive. That derogation includes data transfers whose compliance with the EU principles is secured by the data controller, e.g., by means of standard contractual clauses endorsed by a Member State, codes of conduct etc. The action was triggered by the Commission's May 16, 2003 First Report on the Transposition of the Data Protection Directive, which found that very few notification had been received since the Directive become operational. That fact suggested to the Commission that many unauthorized and possibly illegal transfers to third countries are taking place. The European Commission is seeking to improve the current state of notifications and therefore invites the Member States to notify the authorizations granted. In addition to this reminder to the Member States, a new transparency mechanism alerting the Member States and their Data Protection Authorities by the Commission of the notified authorizations will be set up. Thus, we expect added focus on notifications of data transfers by DPAs and by the Commission Click here for the Note on "National Notifications pursuant to Article 26 (3) of the Directive and exchange of best practice of August 21, 2003." For more information on the EU Data Directive, please contact Sheila A. Millar at (202) 434-4143 or by e-mail at millar@khlaw.com, or Marek Lysy at 32(2) 536-0040 or by e-mail at lysy@khlaw.be.