SCCs: New rules governing cross-border data transfers and data exchanges from the EU and EEA

This September brings change to the use of standard contractual clauses (SCCs) governing data transfers from the EU and EEA.

In June this year, the European Commission published two sets of new SCCs, governing cross-border data transfers and data exchanges. The requirements for the use of these are changing with effect from Monday 27 September 2021.

What are SCCs?

SCCs are standard terms and conditions which the sender and the receiver of personal data both sign up to. They set out the terms on which the parties will send data, the standard of safety required and any other obligations. Their aim is to protect personal data when it is being transferred from EU/EEA countries, where the relatively strict provisions of the General Data Protection Regulation (GDPR) apply, to other countries with different and often less stringent data privacy laws. They may need to be used as an ‘appropriate safeguard’ for the personal data being transferred, if the receiving country’s data protection regime has not been the subject of an ‘adequacy decision’ by the EU Commission.

The UK was the subject of an adequacy decision earlier this year, so SCCs do not need to be used for data transfers from the EU/EEA to the UK.

What are the changes?

The new SCCs have the following key features:

Increased obligations on data exporters

• Data exporters (those who send personal data to a third country) must provide data subjects with information regarding their intent to transfer data, including categories of data, the subjects’ right to obtain a copy of the SCCs, and details of any onward transfer.

Rights of data subjects

• Data subjects will be able to enforce the obligations of the SCCs as third-party beneficiaries.
• Data importers (parties located in a third country receiving data) must inform data subjects of a contact point and deal promptly with any complaints or requests.
• In the event of a dispute between a data importer and data subject who invokes their rights as a third-party beneficiary, the data subject can lodge a complaint with the supervisory authority in the relevant Member State, or refer the dispute to a competent court in the EU.

Increased flexibility

• The new SCCs are structured as one modular document that can be adapted to specific scenarios.
• More than two parties can now adhere to contract terms with SCCs, meaning that if additional parties are involved they can accede to the SCCs for their part in a transaction.
• Provisions are included for when sub-processors are involved, including a process for authorisation and the need for a written contract with the sub-processor ensuring the same level of protection.
• Standard provisions are included for the appointment of data processors where needed, whereas before a separate Data Processing Agreement would have to be drafted.

Third country provisions

• The new SCCs contain an obligation to assess the laws and practices of a third country regarding data protection.
• They also address the potential inability of a data importer to comply with new SCCs due to adverse laws in their country, including how to handle government requests for access to personal information.

When do the new SCCs come into effect?

The new SCCs took effect on 27 June 2021, but until now there has been a transitional period during which the old form SCCs could still be used in all contracts. However that transitional period comes to an end on 27 September 2021. Any new data transfers agreed after that date will need to be governed by the new SCCs. All contracts (new and existing) should be utilising the new SCCs by 27 December 2022.

What should you do?

• Ensure all contracts entered into from now onwards incorporate the new form of SCCs.
• Identify existing contracts that will need to be updated over the next fifteen months.
• Identify contracts reflecting the new scenarios accounted for by the SCCs to determine if they will need to be updated.

How can we help?

We can:

• undertake a review of your existing contracts and identify which will need to incorporate the new SCCs
• advise on the amendment of existing contracts to incorporate the new SCCs
• advise on the implementation of the SCCs in future contract negotiations
• act as UK or EU representative via our sister company Willans Data Protection Services. If you are processing data about people in the UK or EU (as the case may be) and don’t have an establishment in those territories, the EU and UK versions of GDPR require you to appoint a local representative.

Our specialist GDPR and data protection solicitors will make the effort to get to know your business, using this knowledge to create workable solutions to any kind of data protection compliance challenge you may face. Whether you’re looking for a comprehensive solution, training or help with certain aspects of data protection law, please contact us.