The Article 29 Working Party (WP29) has confirmed that Google's model contractual clauses for cross-border transfers of personal data for European business customers of G-Suite (formerly Google Apps) and Google Cloud Platform (GCP) meet the requirements of the EU's Data Protection Directive (95/46/EC).

In line with the WP29's "Working Document Setting Forth a Co-Operation Procedure for Issuing Common Opinions on “Contractual clauses” Considered as compliant with the EC Model Clauses" (WP 226), some EU data protection authorities (DPAs), with the Irish DPA acting as Lead DPA, analysed Google's model clauses, which are based on the European Commission's model clauses with some additions, and decided that they meet the requirements set out in Commission Decision Standard Contractual Clauses 2010/87/EU (EU controller to non-EU/EEA processor). They should not, therefore, be considered "ad hoc" clauses, that is, clauses created for a particular service that substantially differ from the European Commission's model clauses and don't have the same legal value.

In practice, this will enable Google's European business customers to rely on Google's model clauses for transfers of personal data from EU member states to the USA without further authorisations. Google's customers can, subject to the relevant regulatory requirements, enter into the applicable model clauses for G-Suite and GCP services online. The Irish DPC's decision letters (see G-Suite and GCP) point out that this is a limited analysis and does not include the Appendices, which Google and its customers will still need to complete when signing the contract and may be analysed separately by the DPAs.

For further information see Practice note, Cross-border transfers for personal data.

Source: Marc Crandall and Matthew O'Connor blog, Google website, 6 February 2017.