• news-banner

    Expert Insights

Developments to the Standard Contractual Clauses

On 12 November 2020, the European Commission released a draft set of new Standard Contractual Clauses (“SCC”) for personal data transferred from the EU to a third country.  The consultation on the new draft SCCs was closed on the 10 December 2020.  Following closure of the consultation, there is currently no clarity on what changes may be made to the draft pursuant to the consultation or when the new SCCs may be approved.  Whilst there was initially some hope that this may be in Q1 2021, it is true that significant feedback was received which may delay matters.  As currently drafted, once the new SCCs are approved there will be a one year implementation period for businesses to move their contracts onto the new SCC’s.

The ICO has stated that notwithstanding the end of the Brexit transition period (which ended on 31 December 2020) UK businesses can continue to rely on the existing EU SCCs to transfer personal data from the UK to a third country.  The Schrems II decision will also continue to apply to international data transfers from the UK (as well as the EU), meaning that organisations relying on SCCs will have to comply with the CJEU’s direction to assess transfers on a case by case basis and put in place additional safeguards where necessary before any data is transferred. Essentially, this means completing a ‘Transfer Adequacy Assessment’.

As stated above, organisations in the UK may continue to rely on the existing SCCs.  However, the UK ICO has also stated that once the EU SCCs have been finalised, UK authorities will assess and publish their own version of new ‘UK SCCs’ for consultation. Whilst it could be that the only divergence from the EU SCCs made by the UK are those that are deemed necessary to ensure the UK SCCs make sense in a post-Brexit environment (for example, by substituting references to EU institutions and laws with UK ones), but it is possible that the UK authorities may elect to make more expansive changes.

Again, there is no clear guidance as to when the UK SCC’s will be published but when they are finalised the EU SCCs may cease to be valid for any new and/or existing international data transfers from the UK (potentially following a grace period).  Organisations will need to understanding their international data flows to ensure they can seamlessly implemented any new SCCs, whether EU or UK, required in the coming year to ensure legal international data transfers.

We set out below a high level summary of the key changes in the new EU SCC’s: 

  • Data transfers between processors and between EU processors and non-EU controllers are now covered by the SCC’s;
  • New warranties as well as detailed notification and documentation obligations have been inserted to comply with the Schrems II judgement;
  • There is an increase in the obligations placed on non-EU controllers, including obligations to notify EEA authorities of a data breach; and
  • The obligations placed on data importers must be passed on to any further recipients of the personal data to ensure equivalent protections at all times.

Our thinking

  • Doing business in the UAE & Israel

    William Reichert

    Events

  • Charles Russell Speechlys expands commercial offering with the appointment of Rebecca Steer

    Rebecca Steer

    News

  • The Times quotes Gareth Mills on the CMA’s preliminary approval of the Activision Blizzard-Microsoft deal

    Gareth Mills

    In the Press

  • City AM quotes Gareth Mills on the CMA’s new set of principles for regulating AI

    Gareth Mills

    In the Press

  • Silicon quotes Gareth Mills on the UK consumer lawsuit against Google

    Gareth Mills

    In the Press

  • Bloomberg and The Washington Post quote Richard Davies on multiclub ownership in world sports

    Richard Davies

    In the Press

  • Product compliance and Brexit - UK Government concedes to CE markings indefinite recognition

    Jamie Cartwright

    Quick Reads

  • UAE and the Grey List: Brief Update

    Karl Masi

    Insights

  • A Summer of Sport - Top 5 Legal Considerations

    Anna Sowerby

    Insights

  • Has the Orpéa plan impaired shareholder's consent? - Le plan de sauvegarde d'Orpéa n'a-t-il pas vicié le consentement des actionnaires historiques ?

    Dimitri-André Sonier

    Quick Reads

  • The Express quotes Gareth Mills on the CMA’s report on competition in the groceries sector

    Gareth Mills

    In the Press

  • Reuters quotes Gareth Mills on the CMA’s deadline extension of the Microsoft Activision Blizzard deal

    Gareth Mills

    In the Press

  • Will the downturn in the Paris region property market lead property companies to turn to ad hoc proceedings, as they did in the 1990s?

    Dimitri-André Sonier

    Quick Reads

  • Les défaillances en France proches de leur niveau de 2019 - French insolvencies close to 2019 levels

    Dimitri-André Sonier

    Quick Reads

  • Law.com International quotes Simon Ridpath on the use of AI in the legal sector

    Simon Ridpath

    In the Press

  • Casino Group: An agreement with investors and debt holders is expected at the end of July

    Dimitri-André Sonier

    Quick Reads

  • Raconteur quotes Caroline Swain on misleading pricing practices

    Caroline Swain

    In the Press

  • DIAC Issues First Annual Report

    Georgia Fullarton

    Quick Reads

  • PE Hub quotes Richard Davies on private equity interest in football and sports

    Richard Davies

    In the Press

  • Payment Expert quotes Janine Regan on the record £1bn fine against Meta over EU data protection violations

    Janine Regan

    In the Press

  • The Guardian quotes Gareth Mills on Microsoft lodging an appeal against the CMA’s decision to block its Activision Blizzard deal

    Gareth Mills

    In the Press

  • The Times quotes Gareth Mills on the EU’s approval of the Microsoft-Activision deal

    Gareth Mills

    In the Press

  • One year on: "Influencer Culture: lights, camera, inaction" remains astonishingly accurate

    Caroline Swain

    Quick Reads

  • UKTN quotes Gareth Mills on the CMA's review of the UK AI market

    Gareth Mills

    In the Press

  • Saudi Center for Commercial Arbitration publishes new Arbitration Rules

    Peter Smith

    Quick Reads

  • The Financial Times quotes Nick White on risks to content creators promoting counterfeits

    Nick White

    In the Press

  • The Daily Telegraph quotes Nick White on AI and 'workplace displacement'

    Nick White

    In the Press

  • Charles Russell Speechlys achieves record success in The Legal 500 2023 EMEA directory

    Patrick Gearon FCIArb

    News

  • WhatsAppGate - Should businesses be reviewing their social media policies?

    Anna Rogers

    Quick Reads

  • Missed deadline for registering on the overseas entity register

    Sarah Morley

    Quick Reads

  • Dubai announces its plan to streamline the enforcement of civil judgments and arbitral awards

    Peter Smith

    Quick Reads

  • Sign of the times - the British record football transfer which very nearly didn't happen

    Pei Li Kew

    Quick Reads

  • No love (island) lost for the #muffboss – #ad is great but don’t forget the other ad rules

    Caroline Swain

    Quick Reads

  • Is it really against the law to share your Netflix password?

    Quick Reads

  • Commercial service charges: "pay now, argue later"!

    Samuel Lear

    Quick Reads

  • Omnichannel innovation essential in the face of outlet decline

    Caroline Swain

    Quick Reads

  • Brand owners now required to police influencers

    Katie Bewick

    Quick Reads

  • Ten Years Since The 2012 Saudi Arbitration Law: Where Are We Now?

    Peter Smith

    Quick Reads

  • Strike a Pose - Usain Bolt files legendary victory celebration as a trademark

    Henry Cuthbert

    Quick Reads

  • ITV takes the plunge and “couples up” with Ebay to dress love island contestants in pre-loved clothing

    Natalie Batra

    Quick Reads

Back to top