Developments to the Standard Contractual Clauses
On 12 November 2020, the European Commission released a draft set of new Standard Contractual Clauses (“SCC”) for personal data transferred from the EU to a third country. The consultation on the new draft SCCs was closed on the 10 December 2020. Following closure of the consultation, there is currently no clarity on what changes may be made to the draft pursuant to the consultation or when the new SCCs may be approved. Whilst there was initially some hope that this may be in Q1 2021, it is true that significant feedback was received which may delay matters. As currently drafted, once the new SCCs are approved there will be a one year implementation period for businesses to move their contracts onto the new SCC’s.
The ICO has stated that notwithstanding the end of the Brexit transition period (which ended on 31 December 2020) UK businesses can continue to rely on the existing EU SCCs to transfer personal data from the UK to a third country. The Schrems II decision will also continue to apply to international data transfers from the UK (as well as the EU), meaning that organisations relying on SCCs will have to comply with the CJEU’s direction to assess transfers on a case by case basis and put in place additional safeguards where necessary before any data is transferred. Essentially, this means completing a ‘Transfer Adequacy Assessment’.
As stated above, organisations in the UK may continue to rely on the existing SCCs. However, the UK ICO has also stated that once the EU SCCs have been finalised, UK authorities will assess and publish their own version of new ‘UK SCCs’ for consultation. Whilst it could be that the only divergence from the EU SCCs made by the UK are those that are deemed necessary to ensure the UK SCCs make sense in a post-Brexit environment (for example, by substituting references to EU institutions and laws with UK ones), but it is possible that the UK authorities may elect to make more expansive changes.
Again, there is no clear guidance as to when the UK SCC’s will be published but when they are finalised the EU SCCs may cease to be valid for any new and/or existing international data transfers from the UK (potentially following a grace period). Organisations will need to understanding their international data flows to ensure they can seamlessly implemented any new SCCs, whether EU or UK, required in the coming year to ensure legal international data transfers.
We set out below a high level summary of the key changes in the new EU SCC’s:
- Data transfers between processors and between EU processors and non-EU controllers are now covered by the SCC’s;
- New warranties as well as detailed notification and documentation obligations have been inserted to comply with the Schrems II judgement;
- There is an increase in the obligations placed on non-EU controllers, including obligations to notify EEA authorities of a data breach; and
- The obligations placed on data importers must be passed on to any further recipients of the personal data to ensure equivalent protections at all times.
For more information contact Jonathan McDonald and Olivia Crane.
Olivia Crane quoted by SoGlos on the increasing issue of cyber fraud being faced by businesses in Gloucestershire
Cyber fraud has cost Gloucestershire businesses around £369,800 in the last 13 months.
Tattoos, athletes and image rights
Campaigns featuring athletes often include visible tattoos and a number of recent legal cases demonstrate the issues that may arise.
Food Sector steps up on climate goals
Blue Sky Linking
Daniel looks at Sky's recent success in obtaining interim protection from infringement of their broadcast rights
Don’t Gamble on Bingo Ads, Warns ASA
The ASA has issued a reminder to advertisers that bingo adverts will be treated as gambling ads for the purpose of standards regulation.
Recording Phone Calls: Don’t take Consent for Granted
What if an interviewee who is being called and interviewed “live” does not actually know he/she is on live television?
Continuing Progress in the Sphere of Inclusive and Non-Discriminatory Advertising
The latest developments from the ASA, CAP and BCAP relating to the advertising regulators’ attempts to tackle discrimination in advertising.
Top 7 Data Protection Tips for Employers
Here are our top 7 data protection tips for employers.
There has been an increase in online phising attacks over the past year - but why?
UK and EU launch two-pronged attack into whether Facebook is abusing a dominant market position
The CMA and the European Commission have said that they intend to work together closely as their respective investigations develop.
Jason Saiban and Caroline Swain among contributors to the ICLG Guide on Digital Business Laws and Regulations in the UK
An overview of the laws and regulations for digital businesses operating in the UK.
Draft Online Safety Bill: Regulating the online world
On 12 May 2021, the UK government published the draft Online Safety Bill...
Counterfeit goods – online platforms and luxury brands take a new collaborative approach
Online retail has been increasing for the best part of a decade due to a shift in consumer behaviour.
Charles Russell Speechlys proud to sponsor the ‘Outstanding Achievement’ award at the final Sunday Times Virgin Fast Track 100 awards
The awards celebrated the successes of Britain’s 100 private companies with the fastest-growing sales.
New foreign ownership rules take effect on 1 June 2021
Trade Marks - what is bad faith?
In any legal dispute, the term ‘bad faith’ is often banded about.
Public Company Update - May 2021
Read the May 2021 edition of our biannual Public Company Update.
Data Protection: All roads lead back to the GDPR
Across the globe, jurisdictions continue to develop their data protection and privacy laws.
Music to our ears? Well, perhaps not for Apple.
A feud first began when the music streaming giant, Spotify, filed a complaint against music streaming provide rand competitor, Apple Inc.
Risk allocation in commercial leases: the High Court considers rent suspension, insurance and frustration arguments
Read our summary of the full judgement on the latest Covid arrears case.