Privacy & Information Security Law Blog

On November 12, 2020, the European Commission published a draft implementing decision on standard contractual clauses for the transfer of personal data to third countries pursuant to the EU General Data Protection Regulation (“GDPR”), along with its draft set of new standard contractual clauses (the “SCCs”).

Key Takeaways

Key takeaways regarding the draft implementing decision and the SCCs include:

• The SCCs seek to take into account the complexity of modern processing chains by combining a number of general provisions with several modular provisions that should be selected based on the status of the parties under the GDPR, namely provisions for (1) controller-to-controller transfers; (2) controller-to-processor transfers; (3) processor-to-processor transfers; and (4) processor-to-controller transfers (in particular where the EU processor combines personal data received from the third-country controller with personal data collected in the EU).
• The general clauses include language regarding the: (1) obligation for the parties to ensure that the data protection laws in the receiving country, including any requirements to disclose personal data or measures authorizing access by public authorities, do not prevent the data importer from fulfilling its obligations under the SCCs; (2) obligations of the data importer, with respect to government access requests, to notify the exporter of such requests, review the legality of the request and ensure that only the minimum amount of information as permissible under law is provided when responding to a request; (3) redress mechanism available to data subjects; (4) indemnification of the parties in the event of a breach of the SCCs; (5) supervision of transfers by supervisory authorities; (6) obligations of the parties, in the event the data importer is unable to comply with the SCCs; (7) termination of the SCCs; (8) parties’ ability to choose the law of one of the EU Member States to govern the SCCs, which must allow for third-party beneficiary rights; and (9) choice of forum and jurisdiction in the event of a dispute arising from the SCCs.
• Controllers and processors should select the module clauses applicable to their situation and tailor their obligations under the SCCs to their corresponding roles and responsibilities in relation to the data processing at issue. Depending on designation of the parties as controller or processor, the modular clauses for transfers include language regarding the: (1) data protection safeguards that must be implemented by the parties depending on their designation under the GDPR, including safeguards relating to the instructions that must be provided for the transfer, transparency, purpose limitation, accuracy and data minimization, storage limitation, erasure and return of data, security, transfer of sensitive data and data relating to criminal convictions or offences, onward transfers and accountability obligations of the parties; (2) appointment of sub-processors in the context of controller-to-processor and processor-to-processor transfers; (3) data subject rights and the parties’ obligations in the event of a data subject rights request; and (4) parties’ liability under the SCCs.
• Annex I to the SCCs must be completed by the parties and includes (1) a description of the transfers, including the categories of data subjects whose personal data is transferred, categories of personal data transferred, purpose(s) of the transfer and further processing, maximum data retention periods, if applicable, and, for transfers to (sub)-processors, the subject matter, nature and duration of the processing; and (2) a list of parties to the SCCs. The SCCs explicitly contemplate execution between three or more parties and the accession of additional parties throughout the life cycle of the contract. Further, Annex II to the SCCs should be completed by the data importer(s) to include a description of the technical and organizational measures implemented to ensure an appropriate level of security for the data transferred. Finally, Annex III to the SCCs should list the sub-processors used by the processor, if applicable.
• Controllers or processors may incorporate the SCCs into a broader contract and may include additional clauses or safeguards, provided that they do not contradict directly or indirectly the SCCs or prejudice data subjects’ fundamental rights or freedoms. Controllers and processors are encouraged to provide additional safeguards via contractual commitments that supplement the SCCs.
• Data subjects must be provided with a copy of the SCCs upon request and informed of any change of purpose and of the identity of any third-party to whom the personal data is disclosed. With respect to onward transfers to additional recipients in third countries, transfers are allowed only if (1) the recipient accedes to the SCCs; (2) protection of the personal data transferred is ensured by other means; or (3) data subjects’ provide informed and explicit consent.
• Controllers and processors may continue to rely on the existing SCCs during a transitional period of one year from the adoption of the new SCCs, provided that the contract remains unchanged, with the exception of the inclusion of necessary supplementary measures to ensure that the transfer of personal data is subject to appropriate safeguards.

Next Steps

The SCCs are open for public consultation until December 10, 2020, and feedback may be submitted here. The adoption process for the SCCs requires an opinion of the European Data Protection Board and the European Data Protection Supervisor, and the positive vote of EU Member States through the comitology procedure. The final SCCs are expected to be adopted in early 2021.