New Standard Contractual Clauses for transfers of personal data outside the EU/EEA
Following the decision in the Schrems II case, SCC’s have increasingly been used as a legal basis for transfers of personal data from EU/EEA to third countries. The purpose of using the SCC as a basis for transfer is to ensure that the person to whom personal data relates is guaranteed the same rights over his personal data as if this personal data were only processed in the EU/EEA.
The European Commission has now issued modernized SCC’s, which to a greater extent than the previous Standard Contractual Clauses can help to ensure that the person's rights can continue to be enforced at the same level as provided for in the GDPR.
The new SCC’s can be used both for transfers between data controllers, from a data controller to a data processor and - as something new - for transfers between a data processor and a subprocessor outside the EU. The latter has been a major shortcoming of the current SCC’s, and it will make the paperwork significantly easier, when a data processor uses subprocessors outside the EU/EEA.
These modernized SCC’s replace the three previous sets of SCC’s adopted under the previous Data Protection Directive 95/46/ EC of 24 October 1995. Already established SCC’s based on the previous version remain valid for 18 months. Thereafter, new agreements must be based on the new SCC’s.
The new SCC’s contain, among other things, provisions on the supremacy of the SCC’s as well as the obligations of the transfer actors in all transfer scenarios from a data exporter within an EU/EEA country to a data exporter outside an EU/EEA country. Thus, the new SCC’s illustrate a desire for the EU to ensure the protection of EU citizens' personal data, which has otherwise been implemented through the GDPR.
The following are typical examples of situations where the new SCC’s apply:
- Transfer of personal data from a data controller in an EU/EEA country to a data controller in a third country
- Data processing for a data controller in an EU/EEA country to a data processor in a third country
- Data processing for a data processor in an EU/EEA country to a subprocessor in a third country
It is important to pay special attention when using cloud providers or IT support provided outside the EU/EEA, as such situations will also have to be regulated by the SCC if de facto or possible access to personal data is provided.
If you have questions about the new Standard Contractual Clauses or questions on how they will affect your company, please do not hesitate to contact Associate Partner, Attorney Torsten Hylleberg on +45 33 300 252 or thy@les.dk.
