European Commission publishes draft of new standard contractual clauses

On November 12, 2020, the European Commission published a draft Implementing Decision on Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), over two years after the GDPR came into force. This was released along with its draft set of new standard contractual clauses (the “New SCCs”). This publication follows the European Data Protection Board’s (“EDPB”) adopting recommendations on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, as well as recommendations on the European Essential Guarantees for surveillance measures. These were two documents that were adopted as a follow-up to the CJEU’s ‘Schrems II’ ruling. (Our update covering the Schrems II ruling can be located here.

Some key points of the Implementing Decision are listed below -

1. Modular Approach: The European Commission states that developments in the digital economy since the adoption of the current SCCs call for a modernization of the existing versions to better reflect the realities of modern data processing operations. The New SCCs introduce various modules to be used by companies, depending on the designation of the parties namely (i) controller-to-controller transfers, (ii) controller-to-processor transfers, (iii) processor-to-processor transfers and (iv) processor-to-controller transfers.

2. Compliance of Third Country with Contractual Provisions: The European Commission also reaffirms the CJEU's Schrems II decision by reiterating that the transfer of personal data under the SCCs should only take place if the laws of the third country of destination do not prevent the data importer from complying with the contractual provisions. The SCCs now include a mutual warranty stating that the contracting parties have no reason to believe that the laws applicable to the data importer prevent that data importer from fulfilling its obligations under the SCCs.

3. Transitional Period: Once the European Commission adopts the final version of the new SCCs, there will be a transitional period of one year from the date of entry into force of the Implementing Decision. During this transitional period, data exporters and data importers may continue to rely on existing SCCs for the performance of contracts concluded before that date, provided that: (i) the contract remains unchanged, and (ii) any necessary supplementary measures are implemented in order to ensure that the transfer of personal data is subject to appropriate safeguards.

This draft is open for feedback and public consultation for four weeks until December 10, 2020. The adoption process for the New SCCs will be subject to an opinion of the European Data Protection Board, and the vote of EU Member States through the established comitology procedure.

The draft can be accessed here.