The European Commission adopted revised standard contractual clauses for international transfers (the “new SCCs”) on Friday, 4 June 2021. The new SCCs incorporate a number of additional provisions intended to strengthen the degree of protection for personal data transferred to “third countries”, such as the United States, which have not been recognised by the European Commission as providing “adequate” protection.
The adoption of the revised SCCs follows the Court of Justice of the European Union’s (“CJEU”) ruling in the Schrems II judgment (Case c-311/18) which invalidated the EU–US Privacy Shield mechanism and determined that transfers based on the SCCs could continue provided that a level of protection over the transferred personal data that was “essentially equivalent” to that provided by the General Data Protection Regulation (2016/679) (“GDPR”) could be guaranteed (additional recommendations for complying with Schrems II available here).
The Commission notes the new SCCs offer the following main innovations:
- One single entry-point covering a broad range of transfer scenarios (i.e. a composite approach), instead of separate sets of clauses;
- More flexibility for complex processing chains, through a ‘modular approach' and by offering the possibility for more than two parties to join and use the clauses;
- Practical toolbox to comply with the Schrems II judgment; i.e. an overview of the different steps companies have to take to comply with the Schrems II judgment as well as examples of possible ‘supplementary measures', such as encryption, that companies may take if necessary; and
- For controllers and processors that are currently using previous sets of standard contractual clauses, a transition period of 18 months is provided (noting that the new standard contractual clauses must be utilised for new transfers once they have entered into force).
The new SCCs will be published the Official Journal of the European Union in the coming days and enters into force after 20 days. At the same time - and with less fanfare - a set of model data processing clauses (i.e. controller/processor clauses without an international transfer) will also be published.
We will follow up this update with our analysis of the new SCCs and the impact for businesses looking to rely upon them.
[View source.]
