Last week the European Commission approved a second set of standardized contract provisions for data protection when data is transferred from an EU country to a country not recognized by the Commission as providing adequate protection for personally identifiable data. Links to the clauses etc. in the announcement. (Canada is recognized by the EC as having adequate data protection).
The first set of clauses were criticized by some interested groups; these provisions are the result of work done to address these concerns.