INTRODUCTION

This Policy (“Policy”) sets out the 9 Data Protection Principles which Howarth and Srodon Notaries Public (“Business”) commits to comply with when processing personal data in the course of its business of providing notarial services.

The steps which must be followed are:

Step 1: Establish whether the Supplier is a Data Controller or a Data Processor

Step 2: Comply with data protection law requirements in the procurement process 

Step 3: Check whether personal data will be transferred outside the European Economic Area (EEA) 

Step 4: Complete the self-assessment Checklist to ensure compliance with this Policy 

This Policy does not apply if the Supplier’s services do not involve the processing of personal data (for example where it is solely a contract for the purchase of goods, such as hardware).

Whenever it is proposed to appoint a Supplier to which this Policy applies, it is important to first identify whether the Supplier is a “Data Controller” or a “Data Processor”.

• A Data Controller means a party that determines the purposes (that is, why the information is being processed) and means (that is, how the information is being processed) of processing. To identify this, one should ask: is the Supplier the controlling mind behind the proposed activity?  Is the Supplier deciding what personal data will be collected and what it will be used for, or is it the Business? Often it is the person who “owns” the personal data.  Broadly speaking, whoever “calls the shots” in relation to the personal data is likely to be a Data Controller. In the majority of cases the Supplier will likely be a Data Processor of the Business rather than a Data Controller. However, there may be situations where the Business appoints a Supplier who will be a Data Controller, as is shown in the examples below.
• A Data Processor means a party that processes the personal data on behalf of the Data Controller. To identify this, one should ask: is the Supplier carrying out the processing only because it has been instructed to do so by the Business? If so, the Supplier will usually be a Data Processor.

It is important to identify whether the Supplier is a Data Controller or Data Processor because:

• If a Supplier is a Data Controller it will be directly responsible for complying with EU data protection laws (for example ensuring that the processing of the personal data is fair and lawful, and enabling individuals to exercise their rights under data protection laws).
• If a Supplier is a Data Processor, it will still have some direct obligations under EU data protection laws. However, its primary obligations will be imposed under contract with the Data Controller, i.e. the Business. The Business will be legally responsible for all processing performed by its Data Processors, and so it is crucial that strict controls are placed on the Data Processor’s actions.

If the Supplier will be acting as a Data Controller:

As mentioned above, it is less likely that a Supplier will be acting as Data Controller and the majority of Suppliers will be Data Processors. However, if the Supplier is indeed a Data Controller:

• The contract with the Supplier should contain standard terms for Data Controllers set out in Appendix 2.

  Please note that Data Controllers which are public authorities are less likely to accept a written agreement from the Business as they act under their official authority. In these cases, it may be reasonable for the Business to assume that the Data Controller will comply with its legal obligations even if no agreement is entered into. However, in some cases public authorities may still be considered Data Processors especially if they act outside their official authority and a written agreement (as per Steps 2 and 3) may be required. The Business should ensure that only such minimal possible personal data is shared with such public authorities as is required to carry out the relevant acts.

• Step 2 will not apply and Step 3, regarding data transfers, should be considered.

Because the Business will be responsible for the actions of its Data Processors, there are certain steps which must be taken to protect the Business when appointing a Supplier who is a Data Processor.

In addition, when contracting with a Supplier who is a Data Processor, the Business is under a legal obligation to ensure certain mandatory provisions concerning personal data are included in the contract with the Data Processor. These provisions are reflected in the standard Data Processing Agreement.

The following table outlines the practical steps which should be taken during the procurement process to ensure that data protection legal obligations are met.

This Step 3 should be completed whether the Supplier will be acting as a Data Controller or a Data Processor.

In considering whether to appoint a Supplier, the following should be established:

• whether the Supplier is, itself, located outside the EEA; or
• whether the Supplier may subsequently transfer personal data outside the EEA (for example to the Supplier’s subsidiaries or subcontractors).

A ‘transfer’ of personal data includes the following:

• allowing personal data stored in the EEA to be accessed remotely from a country outside the EEA (e.g. the US);
• relocating a database outside the EEA; or
• sending a data set (for example an Excel file) as an attachment to an email to a recipient outside the EEA.

Subject to the exceptions set out below, personal data should not be transferred from an EEA country to a non-EEA country unless there are means of providing appropriate safeguards for that personal data.

A small number of countries (Andorra, Argentina, Canada, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay) have been legally recognised to provide an adequate level of protection and personal data can therefore be transferred from the EEA to those countries.  The list of “adequate” countries can be found on the Commission’s website here.

The US is also regarded as “adequate” if the US recipient (whether the Supplier or a subcontractor) is certified with the EU-US Privacy Shield, and their certification covers the type of personal data which will be transferred. If the Supplier wants to rely on Privacy Shield, the recipient’s certification should be checked on the online list. If the Supplier will be relying on Privacy Shield, ensure it is subject to an obligation to maintain its Privacy Shield status for the duration of the agreement (or ensure the relevant US recipient does), and is obliged to enter into an alternative transfer solution if Privacy Shield is no longer valid.

For countries outside the EEA and not listed above an alternative solution has to be adopted before personal data can be transferred. The most relevant to the Business is likely to be requiring the non-EEA recipient to sign up to an approved set of international data transfer clauses, known as the ‘EU Model Clauses’. Which version of the Clauses should be used depends on whether the Supplier is acting as a Controller or a Processor. The EU Model Clauses should not be amended by the parties. The Appendices will need to be completed prior to execution.

Summary of the contractual arrangements which must be in place:

Exceptions 

In some circumstances transfers may be made without ensuring appropriate safeguards for the transferred personal data, as explained above. These exceptions will mostly concern transfers instructed by the client rather than transfers to a Supplier of the Business.

These are the main exceptions that are likely to apply. However, in some circumstances further exceptions may apply.

To ensure compliance with the requirements of this Policy, the self-assessment checklist in Appendix 1 should be completed.

Last updated January 2020

APPENDIX 1

SUPPLIER APPOINTMENT SELF-ASSESSMENT CHECKLIST

This checklist will help you determine whether this Policy has been complied with. If any of your answers is “No”, further information from the Supplier or independent legal advice should be sought.

APPENDIX 2

STANDARD DATA PROTECTION TERMS: DATA CONTROLLERS

[INSTRUCTIONS FOR USE: This clause is intended for inclusion in a services agreement where a Supplier will be acting as a Data Controller (i.e. it determines the purposes and means of the processing of the personal data from the Business). 

Remove all Drafting Notes prior to sharing with the Supplier]

[Ensure the Services Agreement contains defined terms for “Agreement”, “Services”, “Supplier” (which must include all EU affiliates)]

DATA PROTECTION

1. In this clause [1], the terms “personal data”, “process”, “data controller” and “data processor” shall have the meanings set out in the Data Protection Legislation.
2. The Supplier acknowledges that it shall be acting as an independent data controller in respect of Customer personal data.
3. Without prejudice to clause [1.2], if circumstances arise whereby the Supplier is acting as a data processor on Customer’s behalf the Supplier shall promptly, on request by Customer, execute written contractual commitments which meet the requirements of the Data Protection Legislation. Until such written commitments can be put in place, this clause [1] shall be interpreted to give the closest possible effect to the requirements of the Data Protection Legislation.
4. The Supplier shall comply with its obligations under the Data Protection Legislation in respect of Customer personal data. Without prejudice to the foregoing, the Supplier shall not process Customer personal data in a manner that will or is likely to result in Customer breaching its obligations under the Data Protection Legislation.
5. The Supplier shall only process Customer personal data for the purposes of performing its obligations under this Agreement and for which it was disclosed by Customer to the Supplier.

   [The formulation below should be used if the transfer of data outside the EEA is not contemplated from the outset. Note that if this wording is used, there is no need to include clause [1.6] and [1.7]

6. The Supplier shall not process Customer personal data outside the European Economic Area (“EEA”) (including by way of remote access) without the prior written consent of Customer.]

   [OR]

   [Alternative clause 1.6 which should be used (in combination with clause 1.6 and 1.7) if there will be a transfer of data from the outset:

   Customer hereby consents to Customer personal data being processed outside the EEA, subject to the Supplier’s continued compliance with clause [1.6] and clause [1.7] throughout the duration of this Agreement.]

   [Clause 1.6 and 1.7 are only required if data will be transferred from the outset. Use the formulation below if the service provider is based outside the EEA but is not a US-company registered with Privacy Shield:

7. To the extent that Customer personal data is processed outside the EEA, the terms of the transfer shall be governed by the EU Standard Contractual Clauses for the transfer of personal data to third countries (controller to controller transfers) attached as [Appendix 1], which are hereby incorporated into this Agreement.]

   [The following clause should be included where the Supplier is in the US and certified with Privacy Shield, and its certification covers the data transferred. Note that this clause can still be used if the personal data will subsequently be transferred to a third country by the Supplier, provided the initial transfer is to the US:

   The Supplier hereby warrants and represents that as of the Effective Date it is registered with the EU-US Privacy Shield, approved by the European Commission (Decision of 12th July 2016) (“Privacy Shield”). The Supplier further agrees:

   (a) to maintain its adherence to the Privacy Shield throughout the duration of this Agreement; and
   (b) to immediately inform Customer if at any time the Supplier ceases to be Privacy Shield certified during the term of this Agreement, for whatever reason.]

8. If, for whatever reason, the transfer of Customer personal data under Clause [1.6] ceases to be lawful, the Supplier shall either:

   (a) with Customer’s consent, implement an alternative lawful transfer mechanism; or
   (b) allow Customer to terminate the Agreement at no additional cost to Customer.]

PLEASE INCLUDE APPENDIX 1 INCLUDING THE STANDARD CONTRACTUAL CLAUSES