European Commission Approves Canadian Data Protection Laws - International Law Office

Article 25 of the Data Protection Directive (95/46/EC) (which is the Eighth Data Protection Principle in the UK Data Protection Act 1998) prohibits the transfer of personal data (ie, any information that can identify a person) from inside the European Economic Area (EEA) to third parties in countries that do not have 'adequate levels of protection'.

On December 20 2001 the European Commission officially declared that Canadian data protection laws provide adequate protection for personal data under EU law. Until recently, the commission had approved only two non-EEA countries - Switzerland and Hungary - as having adequate data protection laws.

This means that companies in the EEA can now safely transfer personal data (eg, for processing) to Canada in the same way that they can transfer data within the EEA. Significantly, Canada is the first English-speaking country to be approved by the commission, and is now in the same advantageous position as Switzerland and Hungary as regards the processing of data from the EEA.

Transfers outside the EEA to parties which are not in the 'white-listed' countries and which do not fall within the US Safe Harbour Scheme necessitate a (more uncertain) inquiry of whether the adequacy test is met and whether the exceptions apply to the particular transfer in question. In practical terms, the transferee is often required to comply with data protection principles by way of contract. A set of model contract clauses for controller-to-controller transfers was approved by the European Commission in June 2001, while the set of model contract clauses for controller-to-processor transfers was approved in January 2002.

For further information on this topic please contact Christopher Rees or Carolyn Siauw at Herbert Smith by telephone (+44 20 7374 8000) or by fax (+44 20 7374 0888) or by email (christopher.rees@herbertsmith.com or carolyn.siauw@herbertsmith.com).