decides to continue the transfer or to lift the suspension;
…’
35
Clause 5 in that annex, under the heading ‘Obligations of the data importer …’, provides:
‘The data importer agrees and warrants:
(a)
to process the personal data only on behalf of the data exporter and in compliance with its
instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees
to inform promptly the data exporter of its inability to comply, in which case the data exporter is
entitled to suspend the transfer of data and/or terminate the contract;
(b)
that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the
instructions received from the data exporter and its obligations under the contract and that in the
event of a change in this legislation which is likely to have a substantial adverse effect on the
warranties and obligations provided by the Clauses, it will promptly notify the change to the data
exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer
of data and/or terminate the contract;
…
(d)
that it will promptly notify the data exporter about:
(i)
(ii)
(iii)
any legally binding request for disclosure of the personal data by a law enforcement
authority unless otherwise prohibited, such as a prohibition under criminal law to preserve
the confidentiality of a law enforcement investigation;
any accidental or unauthorised access; and
any request received directly from the data subjects without responding to that request,
unless it has been otherwise authorised to do so;
…’
36
The footnote to the heading of Clause 5 states:
‘Mandatory requirements of the national legislation applicable to the data importer which do not go
beyond what is necessary in a democratic society on the basis of one of the interests listed in
Article 13(1) of Directive [95/46], that is, if they constitute a necessary measure to safeguard national
security, defence, public security, the prevention, investigation, detection and prosecution of criminal
offences or of breaches of ethics for the regulated professions, an important economic or financial
interest of the State or the protection of the data subject or the rights and freedoms of others, are not in
contradiction with the standard contractual clauses. …’
37
Clause 6 in the annex to the SCC Decision, under the heading ‘Liability’, provides:
‘1.
The parties agree that any data subject, who has suffered damage as a result of any breach of the
obligations referred to in Clause 3 or in Clause 11 by any party or sub-processor is entitled to receive
compensation from the data exporter for the damage suffered.
2.
If a data subject is not able to bring a claim for compensation in accordance with paragraph 1
against the data exporter, arising out of a breach by the data importer or his sub-processor of any of
their obligations referred to in Clause 3 or in Clause 11, because the data exporter has factually
disappeared or ceased to exist in law or has become insolvent, the data importer agrees that the data
subject may issue a claim against the data importer as if it were the data exporter …
…’