Читать книгу Privacy and Data Protection based on the GDPR - Leo Besemer - Страница 29

The European Commission can decide on standard contractual clauses that should be used in contracts between controllers, or between a controller and a processor, in order to guarantee sufficient data protection safeguards for personal data to be transferred internationally.

The Commission has issued two sets of standard contractual clauses for data transfers from data controllers established in the European Economic Area (EEA) to data controllers established outside the EEA: decision 2001/497/EC (amended December 2016) and decision 2004/915/EC. The latter model clauses are intended to provide greater flexibility for the contracting parties.

The Commission has also issued one set of contractual clauses for data transfers from controllers in the EEA to processors established outside the EEA, decision 2010/87/EU (which was amended in 2016). The controller-processor contract is discussed in more detail in Sub-section 2.1.5.