Standard contractual clauses in the EU for third country transfers

Standard contractual clauses

If a company wants to personal data If data is transferred to a so-called third country outside the European Union or the European Economic Area, in addition to the legal basis for data processing, a data protection guarantee for the data transfer is also required. If there is a Appropriateness decision The EU Commission has therefore been lacking for years, and the EU—Standard contractual clauses, also known as the European Commission’s Standard Data Protection Clauses (or „SCC“ for short, which stands for Standard Contractual Clauses), are used. These documents, which are now 25 years old, have been updated.

This article is intended to answer the questions that have arisen in this context and thus provide assistance in using the new clauses in compliance with data protection regulations.

If you have any further questions or need assistance with the necessary adjustments, please contact us.

When does my company need SCC?

As soon as a company, either in the role of controller and/or processor personal data have been transferred to a so-called „third country“ in accordance with Art. 44 et seq. of the GDPR Suitable guarantees necessary to protect this data in order to ensure that the level of protection for the personal data of natural persons guaranteed by the GDPR is not undermined.

Unless there is no Appropriateness decision Once the EU Commission has issued its opinion, the SCCs will generally be a key component of this.

How the so-called Schrems II judgment of the European Court of Justice (judgment of 16.07.2020, case C 311/18), the guarantees listed in Art. 44 et seq. GDPR are not sufficient on their own. Rather, the data protection situation in the recipient country must be examined and it must be determined which further technical and organizational measures (Encryption, Anonymization, Pseudonymization) that are additionally required in each specific case.

One possible outcome of such a risk assessment may also be the decision not to proceed with the planned data transfer and to find a European solution instead.

How do the new SCCs differ from the old ones?

The previous Standard contractual clauses The new SCCs have now been adapted to the wording and requirements of the GDPR.

The new SCCs have a modular structure and offer significantly more options for customization, but they also require more work before they can be used for a specific data transfer. Whereas with the previous SCCs, the customization process was usually complete once the details of the two contracting parties had been filled in, with the new SCCs, the actual drafting of the contractual clauses only begins at that point.

Under the new SCC, other institutions can, for the first time, apply to a based on the Standard contractual clauses The data importers and exporters can join the contract as data importers or exporters.

Until now, there were no provisions covering the scenario involving „data processors and subprocessors.“ The new Standard contractual clauses are designed with a modular structure, making them applicable to a wider range of contracts than before, and also cover contracts at the subcontracting level.

If service providers process data on the instructions of a company, this constitutes a Order processing as defined by the GDPR. In such cases, a so-called data processing agreement (DPA for short) must be entered into. The new Standard contractual clauses now also meet the requirements for a data processing agreement. This means that if a contract based on the Standard contractual clauses Once this is completed, it is no longer mandatory to enter into an additional data processing agreement.

In particular, Clauses 14 and 15 of the new SCCs contain specific safeguards that correspond to some of the additions already made by data protection authorities and the European Data Protection Board (“EDPB”) to the old Standard contractual clauses were proposed in order to meet the requirements of the Schrems II judgment.

Fortunately, the new SCCs now specify that these provisions take precedence and supersede any conflicting clauses in contracts or general terms and conditions (Section I, Clause 5).

In Section II, Chapter 12 contains modular liability clauses and stipulates (together with the provision on the priority of the SCC) in principle that the Liability of the contracting parties is not restricted, for example, by external exclusions of liability in general terms and conditions.

In Section IV (Clauses 17 & 18), the contracting parties can now determine the validity of a specific national law and the place of jurisdiction (within the EU). For example, the validity of German law can be specified, although the Standard contractual clauses be closed by a subsidiary in Italy.

In light of the ongoing discussions regarding data transfers to the United States or other third countries, the data importer undertakes, in Clause 15, among other things, to:

• To make every effort to lift the prohibition on notifying the data exporter or the data subject. The goal should be to ensure that as much information as possible can be communicated as quickly as possible. The data importer therefore undertakes to document the efforts it has made so that it can provide evidence of these efforts upon request by the data exporter.
• To review the legality of the disclosure request, in particular whether the request falls within the scope of the powers conferred on the requesting authority, and to challenge the request if, after careful assessment, he concludes that there are sufficient grounds to believe that the request is unlawful under the laws of the destination country, in accordance with applicable obligations under international law, and in accordance with the principles of „courtesy among nations“ (These refer to actions, practices, and rules observed in international relations between states, based on their sovereignty, friendship, neighborliness, and mutual respect) is unlawful. Under the aforementioned conditions, the data importer must file any available legal remedies. When challenging a request, the data importer shall seek interim measures to suspend the effect of the request until the competent judicial authority has ruled on its merits. The data importer shall not disclose the requested personal data until required to do so under applicable procedural rules.

This obligation may (provided that such disclosure orders are actually issued) result in significant costs for the data importer.

In Clause 14, both parties agree that they have given due consideration to the following aspects in particular:

• the specific circumstances of the Transmissionincluding the length of the processing chain, the number of actors involved and the transmission channels used, intended data onward transfers, the type of recipient, the purpose of the Processingthe categories and format of the personal data transmitted, the economic sector in which the transmission takes place, the storage location of the transmitted data,
• which, in light of the special circumstances of the Transmission the relevant laws and practices of the third country of destination (including those that require the disclosure of data to public authorities or permit public authorities to access such data), as well as the applicable restrictions and safeguards,
• all relevant contractual, technical, or organizational safeguards established to supplement the safeguards set forth in these clauses, including measures taken during the Transmission and with the Processing personal data in the country of destination.

These three points must therefore be taken into account, particularly in the context of data transfers to third countries, as part of the risk assessment and related considerations, and this must be documented.

Can I continue to use the old SCCs?

If you are currently in contract negotiations and renegotiating the new SCCs would cause delays, you may continue to use the old SCCs until September 27, 2021. However, these must be replaced with the new SCCs by December 27, 2022, at the latest.

From September 27, 2021, the new SCCs must be used without exception.

How long can I use old SCCs?

For all newly concluded contracts, the new Standard contractual clauses be taken into account. Until then, the old SCCs could still be used, but they would then have to be replaced by the new SCCs no later than December 27, 2022.

I have a contract with old SCCs. Do I now have to replace these with the new SCCs?

Yes, the existing SCCs must be replaced with the new SCCs by December 27, 2022, at the latest. If the contract expires before that date, replacement is therefore not mandatory.
In the event of relevant contractual changes, the data exporter should take immediate action to replace the existing SCCs with the new ones. For example, when subcontracting processing operations that are the subject of the contract to a subprocessor or contractor.

When do I have to replace old SCCs with new ones?

For existing contracts, the replacement must take place within 18 months, i.e. by December 27, 2022 at the latest. If the corresponding contract or the Processing This means that it is not absolutely necessary to replace them.

What should I do if my contracting party does not want to update the SCC?

In particular, if the collaboration and the associated data exchange with the contracting party are to continue beyond December 27, 2022, the contracting party should be informed of the legal risks (see Section 3.9) and asked to explain the specific reasons for the refusal.

After 25 years of good service, the old SCCs are no longer up to date and are barely capable of addressing the various contractual scenarios in a format that is current and tailored to individual needs. The new SCCs are better suited to current challenges and assist the contracting parties in structuring transfers to third countries in compliance with data protection regulations. Therefore, updating the SCCs would be in the mutual interest of both parties.

If the contracting party nevertheless refuses, it would be prudent to reassess whether to continue the contractual relationship, taking into account the additional risks this would pose to your own company.

With whom must SCCs be concluded?

As soon as a data transfer to a country outside the EU or the EEA is to take place, the new SCCs must be concluded between the respective parties involved.

The new SCCs provide for four different processing configurations (modules), which must be selected accordingly in the SCCs:

• Module One C2C Controller to Controller
  Transmission from one controller (in the EU) to another controller (in a third country)
• Module Two C2P Controller to Processor
  Transmission from the controller (in the EU) to the processor (in the third country)
• Module Three P2P Processor to Processor
  Transmission from one processor (in the EU) to another (sub-) processor (in the third country)
• Module Four P2C Processor to Controller
  Transmission from a processor (in the EU) to the controller (in the third country)

Can I adapt or delete clauses in the SCC?

The new SCCs have a modular design and must be customized using the available modules.

With the exception of selecting the appropriate module or modules, or adding or updating information in the appendix, no other changes or deletions may be made.

But the Standard contractual clauses may be included in a more extensive contract (e.g. as an annex). Further clauses or additional guarantees may also be added, provided that they are neither directly nor indirectly included in the contract. Contradiction are contrary to the other provisions of the SCC or restrict the fundamental rights or freedoms of the data subjects, such as the Rights of data subjects (Art. 15-22 ff. GDPR).

In which language do I have to use the new SCC?

The new version of the SCC is available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en It is available in all European languages and can be used accordingly. We recommend using the language version that you primarily use in your communications with the respective contracting party, or the language in which you have drafted the other contractual documents.

If you wish to use two language versions simultaneously (for example, English for the copy intended for your business partner in the UK and German for your own copy), it is advisable to specify which of the two documents takes precedence in the event of any dispute regarding interpretation.

Do I have to provide the new SCCs to the individuals concerned?

As before, Article 13(1)(f) of the GDPR requires that the data subject be provided with „a reference to the appropriate or suitable safeguards and the means of obtaining a copy of them or where they are available.“ For example:

In cases where there is a Transmission Since the data originates from outside the EU, we have implemented appropriate EU-Standard contractual clauses signed. You can request a copy of these terms from us by emailing SCC-Kopie@unternehmen.de, or you can find them on our website at www.unternehmen.de/scc.

Can I now transfer personal data to third countries, such as the United States, under the new SCCs without taking any further steps? Can I forgo additional safeguards?

No. As part of a mandatory risk assessment, the data protection situation in the recipient country must be evaluated, and appropriate safeguards must be established based on that assessment; otherwise, data processing is not permitted—according to, among others, the Chair of the Data protection conference, will generally not take place.

What risk does my company face if I do without the SCC or use it incorrectly?

In addition to the risk of Warning by interest groups and competitors (competition law) and reputational damage in the event of media coverage of non-compliant data processing, there is a particular risk of sanctions by the competent authorities. Regulatory Authority in the Data protection.

The available sanctions (Art. 58 DS-GV) include

• the ability to conduct investigations in the form of data protection audits,
• to issue a warning,
• to instruct that, where necessary, processing operations be brought into compliance with legal requirements in a specific manner and within a specific time frame,
• the suspension of the Transmission to order the transfer of data to a recipient in a third country or to an international organization,
• a temporary or permanent restriction of the Processingincluding a ban, and/or
• in the event of violations of the provisions regarding the Transmission personal data to a recipient in a third country or to an international organization (Articles 44 through 49 of the GDPR), a fine of up to 20,000.000 EUR or, in the case of a company or corporate group, up to 4 % of its total worldwide annual turnover for the preceding fiscal year, whichever amount is higher.

When selecting a sanction, the Regulatory Authority It is certainly also important to consider whether there were any efforts to use the SCC correctly or whether the SCC was completely disregarded despite the obvious need for it.