On June 4, 2021, the European Commission published the final version of the implementing decision on standard contractual clauses for transfers of personal data to third countries under the EU General Data Protection Regulation (“GDPR”), as well as the final version of the new standard contractual clauses (the “SCCs”). The European Commission had previously published draft versions of the implementing decision and the SCCs in November 2020.

Key Takeaways

 Key takeaways regarding the new SCCs include:

• The SCCs retain the modular approach adopted in the draft version. In particular, they include general provisions that apply to all data transfers that take place under the SCCs, and several modular provisions that must be selected based on the status of the parties under the GDPR. Specifically, the SCCs may be used for (1) controller-to-controller transfers; (2) controller-to-processor transfers; (3) processor-to-processor transfers; and (4) processor-to-controller transfers, and so more accurately reflect the complexity of modern data processing chains. The final version permits contracting parties to include only the language contained in the relevant modules that is applicable to the contracting parties.

• The general clauses address the: (1) obligation for the parties to ensure that the data protection laws in the receiving country (including any requirements to disclose personal data or measures authorizing access by public authorities) do not prevent the data importer from fulfilling its obligations under the SCCs; (2) obligations of the data importer with respect to government access requests (e.g., to notify the exporter of such requests, review the legality of a request and ensure only the minimum amount of information as permissible under law is provided when responding to a request); (3) redress mechanism available to data subjects; (4) liability between the parties in the event of a breach of the SCCs; (5) supervision of transfers by supervisory authorities; (6) obligations of the parties in the event the data importer is unable to comply with the SCCs; (7) termination of the SCCs; (8) parties’ ability to choose the law of one of the EU Member States to govern the SCCs, which must allow for third-party beneficiary rights; and (9) choice of forum and jurisdiction in the event of a dispute arising from the SCCs.

• Controllers and processors should select the module clauses applicable to their situation and tailor their obligations under the SCCs to their corresponding roles and responsibilities in relation to the data processing at issue. Depending on the designation of the parties as controller or processor, the modular clauses for transfers address: (1) data protection safeguards that must be implemented by the parties based on their role under the GDPR (e.g., instructions that must be provided for the transfer, transparency, purpose limitation, accuracy and data minimization, storage limitation, erasure and return of data, security, transfer of sensitive data and data relating to criminal convictions or offences, onward transfers and accountability obligations of the parties); (2) the appointment of sub-processors in the context of controller-to-processor and processor-to-processor transfers; (3) data subject rights and the parties’ obligations in the event of a data subject rights request; and (4) the parties’ liability under the SCCs.

• The SCCs include three annexes attached to the Appendix.

  • Annex I to the SCCs must be completed by the parties and includes (1) a list of parties to the SCCs; (2) a description of the transfers (including the categories of data subjects whose personal data is transferred, categories of personal data transferred, purpose(s) of the transfer and further processing, maximum data retention periods, if applicable, and for transfers to (sub)-processors, the subject matter, nature and duration of the processing); and (3) the identity of the competent supervisory authority for each party to the SCCs. To the extent necessary to adequately describe the data transfers that will take place, the parties should complete a separate version of Annex I for each category of data transfer.

  • Annex II to the SCCs should be completed by the data importer(s) to include a description of the technical and organizational measures implemented to ensure an appropriate level of security for the data transferred.

  • Annex III to the SCCs should list the sub-processors used by the processor, if applicable.

• Data subjects must be provided, free of charge, with a copy of the SCCs upon request and informed if any change of processing purpose or of the identity of any third party to whom the personal data is disclosed. The parties are permitted to redact any portion of the Appendix prior to disclosure to the data subject to protect confidential information, but must provide the data subject with the reasons for such redactions upon request.

• With respect to onward transfers to additional recipients in third countries (including where the additional recipient is located in the same country as the importer), such transfers are prohibited unless the onward transfer recipient agrees to be bound by the SCCs or another exemption applies.

  • Other exemptions that permit onward transfers include where: (1) the recipient is located in a country deemed to provide an adequate level of protection for personal data; (2) the recipient enters into a binding instrument with the importer that ensures the same level of protection as the SCCs; or (3) data subjects provide informed and explicit consent for an onward transfer to the particular recipient (when none of the other exemptions apply).

Next Steps

 The SCCs will become effective 12 days after publication in the Official Journal of the European Union.

The existing SCCs will be repealed three months after the new SCCs are published in the Official Journal, and organizations will not be able to rely on the existing SCCs for new data transfers after that date.

Contracts that already incorporate the existing SCCs (provided that the existing SCCs are unchanged) will continue to constitute a valid data transfer mechanism until 18 months after the new SCCs are published in the Official Journal.

Use in the UK

 The SCCs will not automatically be able to be used in connection with data transfers from the UK. It is expected, however, that the UK Information Commissioner’s Office will adopt a similar set of clauses for data transfers from the UK in due course.