On 4 June, the European Commission (EC) published its finalised version of the new Standard Contractual Clauses (SCCs) for transferring personal data from the EU to third countries (the new SCCs). The new SCCs allow companies and other data importers in third countries to move forward with greater certainty in developing legitimate data transfer mechanisms.
In July 2020, the Court of Justice of the European Union (CJEU) invalidated the long-negotiated Privacy Shield. This mechanism had been implemented to facilitate the legal transfer of personal data between the EU and the US.
In giving their judgement (known as Schrems II), the CJEU ruled that the SCCs were a valid mechanism for the transfer. However, they also noted that controllers relying on SCCS for their data transfers outside the EEA are required to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data in the third country, if the law of the third country ensures a level of protection for the personal data transferred that is essentially equivalent to that guaranteed in the EEA.
As a result, the European Commission published the new Draft Standard Contractual Clauses in November 2020, alongside the guidance on supplementary measures for non-EU transfers. The new SCCs build upon the changes made in the draft SCCs and are a more permanent mechanism to facilitate the flow of data from the EU to third countries.
We wrote about the draft SCCs following their release last year. Read that release here: https://privacy108.com.au/insights/transferring-data-out-of-the-eu-draft-sccs-and-supplementary-measures/
The new SCCs should be relied on to facilitate data transfers between the EU and any third country (outside of the European Economic Area) that has not received an adequacy decision. At the time of writing, Andorra, Argentina, Canada (commercial organisations only), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland, and Uruguay have been recognised by the EC as providing adequate protection. South Korea may be added to that list, with its adequacy decision currently pending.
You can find up-to-date information about adequacy decisions here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
The new SCCs also clarifies the position for non-EU based entities covered by the GDPR by virtue of the extraterritorial scope provisions in Article 3(2). In its implementation of the new SCCs, the European Commission notes that:
The need to comply with the ex EEA transfer provisions was previously a bit of a conundrum for Australian-based organisations, as the GDPR could apply to them but as exporters they technically could not use the previous SCCs (because they were not established in the EU) and as importers they had to treat the importing as a cross border transfer even though they were subject to the GDPR.
Like we saw in the draft SCCs, the new SCCs are available not just for controller to controller or controller to processor transfers, but also for the transfer of data from processor to processor (or processor to sub-processor).
The EC has also retained a risk-based approach when assessing data subject protections in a destination jurisdiction. Specifically, the new SCCS note at (19):
The transfer and processing of personal data under standard contractual clauses should not take place if the laws and practices of the third country of destination prevent the data importer from complying with the clauses. In this context, laws and practices that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) of Regulation (EU) 2016/679 should not be considered as being in conflict with the standard contractual clauses. The parties should warrant that, at the time of agreeing to the standard contractual clauses, they have no reason to believe that the laws and practices applicable to the data importer are not in line with these requirements.
Emphasis is ours.
This is a theme throughout the new SCCs, with reporting requirements for data breaches and data processor and technical safeguards now aligning more closely with the GDPR than previously.
The new SCCs require data importers and data exporters to “implement appropriate technical and organisational measures to ensure the security of the personal data”. Parties are required to outline the agreed security measures in Annex II in specific detail.
You can read more about GDPR requirements and download a free whitepaper on an innovative encryption process designed to meet GDPR cross-border transfer requirements here: https://privacy108.com.au/insights/a-solution-to-the-trans-atlantic-data-transfer-problem-cryptoloc/
The new SCCs introduce tougher rules on onward data transfers. Any onward transfer is only permitted where the data subject is offered equivalent protections, either through the onwards party acceding to the SCCs, informed consent of the data subject, or another measure that promises continuity of the protections.
The new SCCs permit data subjects to lodge a complaint with the supervisory authority (SA) in the member state in which they work or reside or with the SA outlined in Annex I.
You should have already undertaken the inventory and preparation process outlined in the European Data Protection Board (EDPB) draft guidance in supplementary measures to the SCCs.
Based on that inventory, you should analyse the new SCCs to determine whether they affect your operational processes and whether your protections (particularly your technical measures) are sufficient. This assessment should be based on a documented process, and you should create documents outlining your decision making for each data transfer.
Once you’ve performed the assessment, prepare and implement new contracts that replace the old SCCs with the new SCCs prior to 27 December 2022.
If you need assistance undertaking the relevant assessments under the new SCCs, don’t hesitate to reach out.
Oops! We could not locate your form.
"*" indicates required fields
"*" indicates required fields
Privacy 108 collects your name and email to send you our newsletter. If you do not provide this information, we will be unable to send it to you. We may use third-party service providers (such as email marketing platforms) to distribute our communications. Some providers may store information overseas, including in the United States. For more information about how we handle your personal information, including how to access or correct it or make a complaint, please see our Privacy Policy or contact us at hello@privacy108.com.au. You can unsubscribe at any time using the link in our emails or by contacting hello@privacy108.com.au.
