Map, Update, Remediate
What do the European Commission’s new Standard Contractual Clauses mean for you?
On 4 June 2021, the European Commission adopted new standard contractual clauses for transfers of personal data to third countries (“New SCCs”), which are set to come into effect on 27 June 2021 (i.e. 20 days after they were published in the Official Journal of the European Union). The New SCCs will replace both sets of the Commission’s current standard contractual clauses (“Old SCCs”), which are now over a decade old.
Since then, the EU’s data protection regime has undergone a huge transformation, with the introduction of the EU General Data Protection Regulation (the “GDPR”) in 2018 and, more recently, the decision of the Court of Justice of the European Union (“CJEU”) in Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, C-311/18 (“Schrems II”) in July 2020. The New SCCs cover these developments and, as a result, place more onerous obligations on both data exporters and importers.
The New SCCs may be used from 27 June 2021 and must be used in place of the Old SCCs where parties enter into new transfer arrangements from 27 September 2022, following a three-month transition period. Where ongoing transfers are already underway prior to 27 September, parties may still rely on the Old SCCs for a further 15 months until 27 December 2022, provided that details of the processing do not change and that appropriate safeguards for the transfer are otherwise provided.
This update sets out the scope and applicability of the New SCCs and identifies some of the key changes compared to the Old SCCs. It also recommends steps you can take to prepare for the New SCCs.
Download PDF for more information