Council of Europe Model Contract to Ensure Equivalent Data Protection in the Context of Transborder Data Flows (1992) (full-text).
The Model Contract was the result of a joint study by the Council of Europe, the Commission of the European Communities and the International Chamber of Commerce (ICC). The Model Contract is a collection of model clauses designed to ensure "equivalent protection," in the context of transborder data flows, based on the guarantees in Convention 108. As well as being applicable to the equivalent protection clause in the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, the Council of Europe Model Contract provides a useful reference in determining what may amount to “adequate protection” under the EU Directive on the Protection of Personal Data.
Under the Model Contract, the party sending the data warrants that the data have been obtained and handled in accordance with the domestic privacy laws of the country in which it operates. In particular, reference is made to fair and lawful data collection, the purpose for which the data have been stored, the adequacy and relevance of the data, the accuracy of the data and the period for which data storage has been authorized.
The party receiving the data undertakes to abide by the same principles that apply to the data exporter in its home country. To supplement this undertaking, the data receiver also agrees to use the data only for the purposes set out in the contract, to protect sensitive data in the manner required by the domestic law of the data sender, not to communicate the data to a third party unless specifically authorized in the contract and to rectify, delete and update the data as required by the data sender.
The remaining clauses deal with liability for the misuse of the data by the data receiver, rights of data subjects, dispute settlement and termination of the contract. The only detail on the mechanics of dispute resolution is in respect of arbitration (including the use of experts); the contractual requirement is for the parties to establish an “appropriate system of settlement of disputes.” The applicable law is left open as a matter for the parties to determine. This work of the Council of Europe (on contractual solutions) has provided a foundation for further developments.