17/06/2021
The long awaited new Standard Contractual Clauses (SCCs) were finally published by the European Commission on 4 June 2021 in the final Implementing Decision. The SCCs will repeal and replace the existing SCCs and can be used from 27 June 2021, although compliance with them for new agreements will be required from 27 September 2021.
However, the ICO has clarified that new European Commission SCCs will not be valid SCCs for restricted transfers from the UK to a third country and we are expecting the UK to issue its own new SCCs later in 2021. Therefore, the following updates to the SCCs are only relevant for restricted transfers from the EU to a third country which is not subject to an adequacy decision.
More flexibility
The new SCCs cover a wide array of data transfers, including those involving multiple parties, the much awaited processor to sub-processor provisions and for transfers from a processor to its appointing controller. To briefly summarise, the new SCCs can be used for the following types of transfers: (i) controller to controller; (ii) controller to processor; (iii) processor to processor; and (iv) processor to its appointing controller.
Consideration of Schrems II
The new SCCs also take into account a number of additional considerations in light of the Schrems II judgment. These include requirements to consider the level of protection of personal data by the data importer, to notify the data exporter if the data importer is unable to comply with the SCCs, and additional notification requirements covering governance access requests.
Important dates for the diary
27 June 2021 – this if the date the SCCs become effective and can be used in contracts (the Effective Date).
27 September 2021 - the European Commission will allow for the current SCCs to be used for a further 3 months from the Effective Date meaning that contracts entered into during this time can still rely on the current SCCs up until 27 September 2021. After this date, all new contracts must be entered into using the new versions of the SCCs.
27 December 2022 - for existing contracts that rely on the SCCs, there is a transition period of 18 months from the Effective Date during which the parties can replace the SCCs with the new versions (i.e. by 27 December 2022). Watch this space for updates on the new SCCs to be released by the ICO which will apply to restricted transfers from the UK to third countries.
For more information please get in touch with one of our information law experts:
