New Standard Contractual Clauses published on June 4th 2021. GDPR Alert.
know your rights and obligations
Let's discuss your case
As you may now, today – June 4th 2021, the EU (European Comission to be specific) has published new standard contractual clauses. What does it mean to Processor and Controller? A lot… EC set a transitional period of 18 months. What are the key changes?
Please see below:
Key changes: they allow for data transfers between processors and subprocessors. As well as impose new requirements on parties engaging in international data transfers (addressing Schrems II requirements).
Frome the technical point of view it might be very difficult for many companies: these new SCCs have to be published in the official European Journal. They will go into effect 3 months and 20 days after publication. New contracts from that point forward should use the new SCCs. Companies / Organizations are allowed to keep using existing contracts with the current SCCs for an additional 18 months and 20 days from the date of publication. This means that organisations will need to embark on a mass repapering exercise to ensure that all vendor contracts and intra-group agreements contain the new SCCs if personal data is transferred.
New SCCs (Standard Contractual Clauses) have been introduced/adopted to address issues related to Schrems II and sub-processing. Until now, there was no need for technical measures in SCCs, moreover, companies (both controllers and processors) were not required to list all sub-processors. Interestingly, the new SCCs require a new approach in this regard.
„Main innovations of the new standard contractual clauses: Update in line with the General Data Protection Regulation (GDPR); One single entry-point covering a broad range of transfer scenarios, instead of separate sets of clauses; More flexibility for complex processing chains, through a ‘modular approach' and by offering the possibility for more than two parties to join and use the clauses; Practical toolbox to comply with the Schrems II judgment; i.e. an overview of the different steps companies have to take to comply with the Schrems II judgment as well as examples of possible ‘supplementary measures', such as encryption, that companies may take if necessary”
Next major change is that European Comission published both SCCs for international transfers and SCC for controllers and processors. You can find the links below:
1) Standard contractual clauses for international transfers
2) Standard contractual clauses for controllers and processors in the EU/EEA