EU Commission releases a draft version of new Standard Contractual Clauses
Following the big announcement by the EDPB regarding the recommendations on supplementary measures regarding international personal data transfers post Schrems II, the European Commission released a draft for new Standard Contractual Clauses (“SCC’s”).
The new SCC’s are open for public consultation until December 10, 2020 and have been sent to the European Data Protection Board (“EDPB”) and European Data Protection Supervisor (“EDPS”) for their opinion. The final SCC’s are expected to be adopted in early 2021.
In the absence of an adequacy decision by the EU Commission, organisations may transfer personal data to third countries only if they have provided ‘appropriate safeguards’ ensuring that the equivalent level of data protection guaranteed by the EU law is transferred together with the data. The SCC’s are one of the safeguards organisations can rely on. However, keeping in mind the recent EDPB guidelines according to which the SCC’s are not likely to be sufficient when using as a standalone transfer mechanism and therefore organisations are expected to implement ‘supplementary measures’ to ensure they can provide the expected equivalent level of data protection in practice.
New transfer scenarios
The earlier version of the SCC’s based on the old data protection directive addressed two types of scenarios:
- EU based data controller transferring personal data to another controller located outside European Economic Area
- EU based data controller transferring personal data to a processor located outside European Economic Area
The new version of the SCC’s can also be used when a processor transfers personal data to a sub-processor.
See the EU Commission’s draft decision and the new draft Standard Contractual Clauses here.