On 4 June 2021 the European Commission published new Standard Contractual Clauses ("SCC") (Decision (EU) 2021/914) for transferring personal data to countries outside the EU/EEA (so-called "third countries"). The new SCCs will replace the current SCCs adopted under the now repealed EU Data Protection Directive.
What are SCCs?
Similar to the processing of personal data, the transfer of personal data to third countries requires a legal basis. These are listed under Chapter V of the General Data Protection Regulation ("GDPR") (Regulation 2016/679), and should secure that the level of protection under the GDPR is not circumvented or undermined by the third country transfer. SCCs is the most frequently used legal basis for transferring personal data to third countries.
What are the changes?
The main takeaways from the new SCCs are:
- The SCCs introduce a module-based (building-block) approach. This entails that companies are able to apply the SCCs independent of their legal status under the GDPR, consequently expanding their scope of applicability. The different modules cover four potential situations: controller to controller, controller to processor, processor to processor and processor to controller.
- The SCCs introduce a docking clause, meaning that the procedure of including new parties to an already entered SCC has been simplified.
- The SCCs comply with the requirements to data processing agreements under the GDPR. It is therefore not necessary to enter into a data processing agreement in addition to the SCCs.
- As established in the Schrems II-decisions, a transfer to a third-country is only permitted if the relevant third country offers an essentially equivalent protection of personal data as under the GDPR. Important to note is that the entering into the SCCs does not in itself make the transfer legal. The new SCCs reflect the Schrems II-requirement, and require the contracting parties to conduct a transfer impact assessment (TIA). By entering into the SCCs, the contracting parties warrant that they are unaware of any local laws and/or practices affecting the efficiency of the SCCs. The parties are also required to document this assessment and make it available on request to the supervisory authority.
Entry into force
The new SCC regime will take effect on 27 June 2021. Companies may continue to enter into the current SCCs during a three month transition period. All current SCCs entered into prior to the expiration of the aforementioned transmission period will continue to be valid for an additional fifteen months. Consequently, existing SCCs will have to be replaced within eighteen months.
