Depending on whether you are an optimist or a pessimist, it will have taken the European Commission either three years and two weeks (since the entry into force of the General Data Protection Regulation (GDPR) or eleven months (since the Schrems II decision — see our Alert here) to publish its finalized revision of the most flexible tool to allow for the transfer of personal data to partners located in countries not otherwise providing an adequate level of data protection (Adequate Countries): the Standard Contractual Clauses (SCCs).

While Schrems II made headlines with its cancellation of the Privacy Shield framework, this mechanism only affected 5,000 companies in the United States. SCCs, on the other hand, remain the most widely used instrument to ensure an end-to-end sufficient level protection of personal data covered by European data protection. With their original version dating back 2001, an update was severely needed to align them with GDPR’s extensive reach and requirements.

IN A NUTSHELL:

• The new SCCs were published on 4 June 2021:
  • Starting on 27 June 2021, companies will need to transition to the new SCCs;
  • On 27 December 2022, companies must have finalized their transition to the new SCCs.
• Affected companies include:
  • EU-based entities sharing data with partners and providers located in countries deemed not to offer an adequate level of protection;
  • Non EU-based entities otherwise subject to GDPR’s extensive territorial reach (see our Alert here) sharing data with partners and providers located in countries deemed not to offer an adequate level of protection; and
  • Non-EU based entities receiving or processing personal data from or on behalf of EU-based partners or non-EU partners otherwise subject to GDPR.
• Key new elements include:
  • Data exporting entities will need to assess the importing countries’ regulatory framework;
  • Where such framework cannot safeguard the transferred data subject to GDPR, additional measures must be implemented contractually, organizationally and/or technically;
  • Each and every step of the assessment, and the relevancy of the remediation measures, must be thoroughly documented; and
  • In the case of a controller/processor/sub-processor relationship, the new SCCs consolidate the requirements into a single agreement addressing the data processing requirements under Article 28 GDPR and the data transfer agreement.
• While the new SCCs provide for a general framework, many issues are left to:
  • The expected interpretation and guidance from the European Data Protection Board (EDPB); and
  • Contractual negotiations between the stakeholders.