knowledge 9 June 2021 |

Lights, Camera, Action for SCCs! European Commission Adopts New Sets of Standard Contractual Clauses

On 7 June 2021, the European Commission published its decision to adopt new standard contractual clauses (‘SCCs’) pursuant to the General Data Protection Regulation (‘GDPR’) in the Official Journal of the European Union.1  These SCCs may be used to facilitate transfers of personal data outside the EEA under Article 46(1) GDPR.  The new SCCs will replace the ‘old’ standard contractual clauses approved by the European Commission pursuant to the Data Protection Directive (Directive 95/45/EC) on a phased basis.2

The New Clauses

The new SCCs were published in draft form in November 2020; we discussed the main changes in this briefing.  At a high level, the new SCCs facilitate international transfers of personal data between two controllers, a controller and a processor or two processors, which includes some welcome additions to the current regime.  Additionally, the new SCCS place certain obligations on parties in connection with the local laws of the destination jurisdiction.  Recital 18 of the Commission’s Implementing Decision indicates this takes account of the Court of Justice’s judgment in Schrems II, which we outlined in this briefing.

Key Dates for Implementation

For parties transferring personal data to third countries, the following dates are key for their business in relation to the new SCCs:

  • 27 June 2021: the new SCCs will take effect and may be used.
  • 27 September 2021: the decisions under which the old SCCs were adopted will be repealed.  Up until this date, parties have the option of entering into either the new SCCs or the old SCCs to provide for transfers of personal data to a third country. This is a different approach to that originally proposed by the European Commission in November 2020.
  • 27 December 2022: parties who entered into the old SCCs before 27 September 2021 may continue to rely on them until this date.  Afterwards, reliance on the old SCCs will no longer be deemed to provide ‘appropriate safeguards’ and will not comply with Article 46(1) GDPR.  Parties continuing to rely on SCCs for international transfers of personal data should transition to the new SCCs before this date. 

Next Steps

With these dates in mind, businesses should assess their current third country data transfer arrangements in order to ensure a smooth and timely transition to the new SCCs.  In particular, businesses should consider agreements being made before September 2021 as a choice will need to be made on whether the old or new SCCs are relied upon for international transfers of personal data.  They will also need to plan for transitioning all transfer arrangements based on SCCs onto the new SCCs by 27 December 2022.

Also contributed by Aoife Mac Ardle.

  1. Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council. 
  2. Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC and Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council.

This document has been prepared by McCann FitzGerald LLP for general guidance only and should not be regarded as a substitute for professional advice. Such advice should always be taken before acting on any of the matters discussed.