17/06/2021

The long awaited new Standard Contractual Clauses (SCCs) were finally published by the European Commission on 4 June 2021 in the final Implementing Decision. The SCCs will repeal and replace the existing SCCs and can be used from 27 June 2021, although compliance with them for new agreements will be required from 27 September 2021.

However, the ICO has clarified that new European Commission SCCs will not be valid SCCs for restricted transfers from the UK to a third country and we are expecting the UK to issue its own new SCCs later in 2021. Therefore, the following updates to the SCCs are only relevant for restricted transfers from the EU to a third country which is not subject to an adequacy decision.

More flexibility

The new SCCs cover a wide array of data transfers, including those involving multiple parties, the much awaited processor to sub-processor provisions and for transfers from a processor to its appointing controller. To briefly summarise, the new SCCs can be used for the following types of transfers: (i) controller to controller; (ii) controller to processor; (iii) processor to processor; and (iv) processor to its appointing controller.

Consideration of Schrems II

The new SCCs also take into account a number of additional considerations in light of the Schrems II judgment. These include requirements to consider the level of protection of personal data by the data importer, to notify the data exporter if the data importer is unable to comply with the SCCs, and additional notification requirements covering governance access requests.  

Important dates for the diary

27 June 2021 – this if the date the SCCs become effective and can be used in contracts (the Effective Date).

27 September 2021 - the European Commission will allow for the current SCCs to be used for a further 3 months from the Effective Date meaning that contracts entered into during this time can still rely on the current SCCs up until 27 September 2021. After this date, all new contracts must be entered into using the new versions of the SCCs.

27 December 2022 - for existing contracts that rely on the SCCs, there is a transition period of 18 months from the Effective Date during which the parties can replace the SCCs with the new versions (i.e. by 27 December 2022). Watch this space for updates on the new SCCs to be released by the ICO which will apply to restricted transfers from the UK to third countries.

 

For more information please get in touch with one of our information law experts:

Our use of cookies

We use necessary cookies to make our site work. We'd also like to set optional analytics cookies to help us improve it. We won't set optional cookies unless you enable them. Using this tool will set a cookie on your device to remember your preferences. For more detailed information about the cookies we use, see our Cookies page.

Necessary cookies

Necessary cookies enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, but this may affect how the website functions.

Analytics cookies

We'd like to set Google Analytics cookies to help us to improve our website by collection and reporting information on how you use it. The cookies collect information in a way that does not directly identify anyone.
For more information on how these cookies work, please see our Cookies page.