The DaimlerChrysler codes of conduct: The ideal way for global companies to export personal data from Germany to countries outside the EU/EEA?

Computer Law and Security Report

Volumn 20, Issue 3, 2004, Pages 185-193

  Moritz, Hans Werner ^a  

^a Jones Day   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

CONTRACTS; DATA PRIVACY; DATABASE SYSTEMS; ELECTRONIC DOCUMENT EXCHANGE; INDUSTRIAL MANAGEMENT; INTRANETS; LAWS AND LEGISLATION; PERSONNEL; SECURITY OF DATA; TELECOMMUNICATION NETWORKS;

CONTRACT MANAGEMENT; CREDIT BANKS; DATA PROTECTION; NATIONAL STATUTORY REGULATIONS;

DATA TRANSFER;

EID: 84979841866     PISSN: 02673649     EISSN: None     Source Type: Journal    
DOI: 10.1016/S0267-3649(04)00035-4     Document Type: Article

References (22)

1. The standard contractual clauses “Controller to Controller” were adopted by the Commission on June 15, 2001 (OJEC No.L181 of July 4, 2001, 19-31), effective since September 3, 2001; The standard contractual clauses “Controller to Processor” of December 27, 2001 (OJEC No. L 6, January 10, 2002, 52-62), effective since April 3, 2002.
2. Directive 95/46/EC, OJEC No. L 281, November 23, 1995, 31-50.
3. See Räther/Seitz, MMR 2002, 425, 429 and fn 12.
4. According to Dr. Dammann at the Jones Day Symposium on March 18, 2003.
5. See Ehmann/Helfrich, EU Data Protection Directive, brief commentary, 1999, Art. 26, marginal note 3.
6. This has been confirmed by the Article 29 Data Protection Working Party in its Working Document: Transfers of personal data to third countries: Applying Article 26 (2) of the EU Data Protection Directive to Binding Corporate Rules for International Data Transfers, adopted on June 3, 2003, available at www.europa.eu.int/comm/privacy .
7. Rittweger/Weiße, CR 2003, 142, 148.
8. But see Rittweger/Weiße, fn 8 at 148.
9. The binding nature (legal enforceability) of the corporate rules is a “must” according to the Article 29 Data Protection Working Party, fn 7 at 10.
10. Group collective agreements would be possible if a group employee works council was established at DC by a resolution by all of the employee works councils (Sections 54, et seq., Works Council Constitution Act).
11. See Wilhelm Dütz, Labour Law, 7th Edition 2002, marginal note 54.
12. See Wilhelm Dütz, fn 18, marginal note 55.
13. Under German law there are substantive differences between the laws regulating limited liability companies and those regulating stock corporations. Whereas the Managing Director of a limited liability company is generally bound by instructions from the shareholders (Section 37 of the Limited Liability Companies Act), there is not a corresponding obligation on the Management Board of a stock corporation with regard to the shareholders' meeting or the supervisory board. Subjecting the Managing Board of a stock corporation to instructions can only be achieved through a control agreement, for example, between the parent company and the dependent subsidiary (Sections 291, Para. 1, 308 of the German Corporation Act). The relationship to foreign laws is outside the scope of this article.
14. See Golal/Schomerus, GDPA, Commentary 7, Issue 2002, Section 4c marginal note 12.
15. See Rittweger/Weiße, fn. 8 at 148, fn 18 at 149 and there fn 18. In its new Working Document (fn 7), the Article 29 Data Protection Working Party is suggesting a less formal “co-ordinated procedure” (Pg. 20) by pointing to the cooperation duties of the national supervisory authorities provided for in Article 28 (6), DPD. According to the Article 29 Data Protection Working Party “the details of the procedure will be promptly determined case by case by the data protection authorities involved.”
16. Rittweger/Weiße, fn 8 at 149.
17. Contrary to the standard contractual clauses, the DC Codes of Conduct do not contain, for example, explicit clauses on liability. Whether the comparability is to be negated because of this, depends upon whether liability does not already exist because of the law. To the extent that German law applies, liability exists based on Section 280 of the German Civil Code, which appears to allow for the comparability.
18. See the critical acknowledgement of Räther/Seitz, MMR 2002, 425, 429, et seq.
19. As of the beginning of March 2003, there is evidence that only 175 US companies were registered at the US Department of Commerce.
20. In the meantime, the German Working committee “Transnational Data Flow” has also approved a model code of conduct for internationally acting insurance companies, developed by the Association of German Insurance Companies (Gesamtverband der Deutschen Versicherungswirtschaft (GDV)), published in “Dokumente zu Datenschutz und Informationsfreiheit, 2002, by the Berlin Commissioner of Data Protection, 49 – 62.
21. Available at http:\\www.export.gov/safeharbor/ .
22. - to third countries without the supervisory authorities in Baden-Württemberg considering this to be subject to approval.