Commission Implementing Decision on standard contractual clauses between controllers and processors located in the EU

Dear sirs, speaking for Siemens Healthineers and regarding the draft of "Commission Implementing Decision on standard contractual clauses between controllers and processors located in the EU" notably Annex - Ares(2020)6654429 we do submit one comment: ----------------------------------------------- Annex Section II Clause 9 "Notification of personal data breach" (a) (3) regarding the ORIGINAL TEXT "the measures…

DIGITALEUROPE appreciates the opportunity to contribute its input to the new set of standard contractual clauses (SCCs) between controllers and processors located in the EU published by the European Commission. Contract negotiations following the General Data Protection Regulation (GDPR) have centrally revolved around defining clear tasks of the parties, as separate or joint controllers or processors; as in any…

DIGITALEUROPE appreciates the opportunity to contribute its input new set of standard contractual clauses (SCCs) between controllers and processors located in the EU published by the European Commission. Contract negotiations following the General Data Protection Regulation (GDPR) have centrally revolved around defining clear tasks of the parties, as separate or joint controllers or processors; as in any other…

Morrison & Foerster LLP on behalf of the Global Privacy Alliance (GPA) is pleased to offer the attached submission in response to the request for comments on the European Commission’s draft standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

BSA | The Software Alliance (“BSA”), the leading advocate for the global software industry, welcomes the opportunity to provide feedback on the European Commission’s draft new standard contractual clauses (“Article 28 SCCs”) on the matters referred to in Article 28(3) and (4) of Regulation (EU) 2016/679.

Polish IT and Telecommunication Chamber of Commerce comments on the European Commission’s draft implementing decision and Standard Contractual Clauses (SCCs) for the transfer of personal data to non-EEA countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

Please consider deleting part “and at the latest within 48h” in sentence “In the event of a personal data breach concerning data processed by the data processor, it shall notify the data controller without undue delay and at the latest within 48h after having become aware of the breach.” in clause 7.3.(a). It may create problems which arise from human nature.

IATA Response to the European Commission consultation on Implementing Decision on standard contractual clauses between controllers and processors for the matters referred to in Article 28 (3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29 (7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council - See attached

Dear ladies and gentlemen, Boehringer Ingelheim welcomes the opportunity to provide feedback regarding the European Commission’s consultation regarding a draft implementing decision on Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council” set forth in the attached document.

Dear Commission, Please find attached our feedback on the draft Data protection - standard contractual clauses for transferring personal data to non-EU countries (implementing act). Best regards, [name removed] and [name removed] on behalf of the Norwegian Institute of Public Health (NIPH)

As Confartigianato Imprese, we welcome the identification of standard contractual clauses included in the proposal of EC Decision. These clauses are needed because they contribute to define the right relationship between the controller and the processor. This kind of relationship, especially when the contractual power is unequal between parties, can be strongly disadvantageous for the weaker part.

On the Commission Implementation Decision: Article 3 should define how the evaluation of practical application is conducted. At least one method and a minimum sample size, if appropriate, should be defined. On the Annex: Clause 2 (a): States it is prohibited to modify the Clauses. However, options are to be chosen and clause 5 could be excluded what would be an modification. Options could be defined in an Annex.

- In terms of semantics, it is strange that the text uses ‘data controller’ and ‘data processor’ rather than the legally defined concepts of ‘controller’ and ‘processor’ - Clause 7(a): Under article 28.3.a GDPR, the processor must inform the controller of processing required by law, unless legally prohibited to do so.