The CNPD, acting as lead authority, in cooperation with other concerned European Data Protection Authorities pursuant to the Working Document 226, adopted by the Article 29 Working Party, have analysed Amazon Web Services, Inc.’s (AWS) “Data Processing Addendum” and its Annex 2 “Standard Contractual Clauses” which incorporates Commission Decision 2010/87/EU.
The aim of the review by the DPAs was to evaluate whether these documents strictly meet the requirements on international data transfers contained in the Standard Contractual Clauses of the Commission Decision 2010/87/EU (the so-called “controller-to-processor” clauses).
On 6 March 2015, the CNPD issued a letter, confirming that the Data Processing Addendum of AWS was in line with the Standard Contractual Clauses of Commission Decision 2010/87/EU and acknowledging that, by using the “Data Processing Addendum” together with its annexes, AWS will make sufficient contractual commitments to provide a legal framework to its international data flows, in accordance with Article 26 of Directive 95/46/EC. Furthermore, the Luxembourgish DPA thanked AWS for the constructive collaboration that has led to these positive conclusions.