On June 4, 2021, the European Commission introduced the new set of Standard Contractual Clauses (“SCCs”), a primary mechanism for lawfully transferring personal data from Europe to the United States under the European Union’s General Data Protection Regulation. These new SCCs replace the three sets of SCCs that were adopted under the previous Data Protection Directive 95/46. For those entities that entered into a transfer agreement based on the previous SCCs before September 27, 2021, a transition period has been granted until December 27, 2022 to switch to the new SCCs, provided that the processing operations that are the subject matter of the contract remain unchanged. Thus, all new and existing contracts must be transitioned to the new SCCs by December 27, 2022. Below is an overview of key updates in the new SCCs, and recommendations for ensuring compliance prior to the December 27, 2022 deadline.
Important Updates for the New SCCS
Modular Approach
The new SCCs are divided into four modules to address four different cross-border transfer scenarios: (i) Module One: controller to controller; (ii) Module Two: controller to processor; (iii) Module Three: processor to processor; and (iv) Module Four: processor to controller. This is different from the previous SCCs, which only contemplated cross-border transfer scenarios involving two controllers, and a controller to a processor. Under the new SCCs, the parties can tailor the clauses for their specific transfer scenario, reflecting the complexity of modern processing chains.
Transfer Impact Assessment
The new SCCs impose an obligation on the parties in all modules to conduct and record a transfer impact assessment. At the time of entering into the new SCCs, the parties must warrant that they have no reason to believe that the laws and practices applicable to the data importer are not in line with the requirements under the new SCCs. In conducting the transfer impact assessment, the parties must also account for the circumstances of the intended transfer, define the parameters of the transfer (i.e. length of processing chain), define the safeguards that are implemented, and assess the risk posed by the laws and practices of the third country of destination.
Docking Clause
While the previous SCCs did not permit additional parties to join directly, the new SCCs contain a clause that allow additional data exporters or importers to accede to the new SCCs throughout the lifecycle of the contract. The acceding party will have the rights and obligations arising under the new SCCs from the point of entering into the new SCCs.
Recommendations
In addition to using the new SCCs in any future contracts that involve data transfers from the European Union, entities should develop strategies to prioritize and update existing contracts that involve personal data transfers from Europe to the U.S. Entities need to determine if the new SCCs are needed for cross-border transfer scenarios involving a processor to a controller or a processor to a processor, as the previous SCCs were not required for these scenarios. It is critical that entities identify all existing contracts that will need to be amended to include the new SCCs before the deadline of December 27, 2022.