Arbitration

Model Data Protection Clause for Procedural Order One

  • 12 January 2021

Model Data Protection Clause for Procedural Order One

This model is intended to provide arbitrators with guidance in the drafting of a data protection clause in Procedural Order One, when the arbitral tribunal considers that the General Data Protection Regulation (“GDPR”) (EU Regulation 2016/679) or other similar data protection laws and regulations apply to the arbitration.

Go directly to:

This model is intended to provide arbitrators with guidance in the drafting of a data protection clause in Procedural Order One, when the arbitral tribunal considers that the General Data Protection Regulation (“GDPR”) (EU Regulation 2016/679) or other similar data protection laws and regulations apply to the arbitration. It does not constitute an exhaustive, mandatory or otherwise binding document.

For any questions, the arbitrators may contact the case management team in charge of the file.

  1. When personal data is submitted during the arbitration, unless otherwise agreed or ordered in advance, it will be processed based on the legitimate interest of the parties, the arbitrators, and others impacted by the proceeding in ensuring that the arbitration is administered in accordance with the ICC Rules in a fair, impartial, and efficient manner and that the rights of the parties are protected, except where such fundamental rights and interests are overridden by the interests or fundamental rights and freedoms of the data subjects.
  2. If sensitive/special category data is submitted during the arbitration, it shall be processed to the extent necessary to establish, exercise, or defend legal claims in the arbitration.
  3. Personal data will be transferred outside the European Union (EU) during the arbitration only when there is a lawful basis to do so, which unless otherwise agreed or ordered in advance will be (1) because the EU considers the country of transfer to provide adequate protection; (2) standard contractual clauses have been put in place; or (3) another lawful basis applies, for example, the personal data is necessary to establish, exercise, or defend legal claims in the arbitration. In all cases of personal data transfer outside the EEA in the context of the proceeding, reasonable measures shall be put in place to ensure that the data protection principles established in the relevant data protection law are complied with after transfer.
  4. The parties and their legal representatives shall not do anything contrary to the principles set forth in paragraphs 1 through 4, for example seeking consent, without first raising the issue with the tribunal and obtaining directions.

(…)

Also available in: