As long as we talked about Safe Harbor in the last entry, we might as well talk about model contracts. Honestly, I don’t like this one as much as it’s really an avenue for data protection that comes out of the EU. However, data protection laws are rampant all over the world and the EU is not the only one creating them. Model contracts are in effect (my interpretation) lines of specific text that go into employee contracts to inform them about the use of their data over the life of their employment. It is absolutely much simpler than certifying to safe harbors, but I have not seen any indication that they comply to (for example) Asian requirements around data protections.
I personally think it’s fair to say that if you are a global organization in the Americas and EU, you will eventually have operations and employees in other parts of the world. If that assumption is fair, then in my opinion you might as well pursue safe harbors under the US Department of Commerce.
There is quite a nice EU website here ((http://ec.europa.eu/justice_home/fsj/privacy/modelcontracts/index_en.htm)) to tell you more about model contracts than you ever wanted to know.
2 responses to “Global Data Protection – Model Contracts”
Indeed, European regulators have made it clear that consent can play only a limited role in data protection compliance in the employment context. At the same time, consent may be useful (for example, in providing a legal basis for the data transfers needed in a stock options program) and in some circumstances is required (for example, as recognized in the Safe Harbor Choice Principle, when wanting to use transferred data for a new purpose).
Incidentally, in the A-Little-Knowledge-Can-Be-A-Dangerous-Thing Department, the Wikipedia entry on Safe Harbor needs a lot of work, mis-stating the scope, program requirements and oversight role of the FTC, and focusing only on criticisms without reference to many positive evaluations of the program.
Finally, while Safe Harbor works well for multi-nationals that are US-centric in either management style or data flows, it is of little value to companies that export HR data from Europe directly to third countries around the world. For these multi-nationals model contracts or BCRs are the only compliance options available.
Model contracts… I agree, the very mention of them is enough to cause eyes to glaze over… are not employment contracts. The contracts are signed by the exporting and importing business units of a company, imposing enforceable legal obligations on each. They are instruments, approved by the European Commission, that are designed to extend European data protection requirements beyond the borders of Europe.