Developments to the Standard Contractual Clauses
On 12 November 2020, the European Commission released a draft set of new Standard Contractual Clauses (“SCC”) for personal data transferred from the EU to a third country. The consultation on the new draft SCCs was closed on the 10 December 2020. Following closure of the consultation, there is currently no clarity on what changes may be made to the draft pursuant to the consultation or when the new SCCs may be approved. Whilst there was initially some hope that this may be in Q1 2021, it is true that significant feedback was received which may delay matters. As currently drafted, once the new SCCs are approved there will be a one year implementation period for businesses to move their contracts onto the new SCC’s.
The ICO has stated that notwithstanding the end of the Brexit transition period (which ended on 31 December 2020) UK businesses can continue to rely on the existing EU SCCs to transfer personal data from the UK to a third country. The Schrems II decision will also continue to apply to international data transfers from the UK (as well as the EU), meaning that organisations relying on SCCs will have to comply with the CJEU’s direction to assess transfers on a case by case basis and put in place additional safeguards where necessary before any data is transferred. Essentially, this means completing a ‘Transfer Adequacy Assessment’.
As stated above, organisations in the UK may continue to rely on the existing SCCs. However, the UK ICO has also stated that once the EU SCCs have been finalised, UK authorities will assess and publish their own version of new ‘UK SCCs’ for consultation. Whilst it could be that the only divergence from the EU SCCs made by the UK are those that are deemed necessary to ensure the UK SCCs make sense in a post-Brexit environment (for example, by substituting references to EU institutions and laws with UK ones), but it is possible that the UK authorities may elect to make more expansive changes.
Again, there is no clear guidance as to when the UK SCC’s will be published but when they are finalised the EU SCCs may cease to be valid for any new and/or existing international data transfers from the UK (potentially following a grace period). Organisations will need to understanding their international data flows to ensure they can seamlessly implemented any new SCCs, whether EU or UK, required in the coming year to ensure legal international data transfers.
We set out below a high level summary of the key changes in the new EU SCC’s:
- Data transfers between processors and between EU processors and non-EU controllers are now covered by the SCC’s;
- New warranties as well as detailed notification and documentation obligations have been inserted to comply with the Schrems II judgement;
- There is an increase in the obligations placed on non-EU controllers, including obligations to notify EEA authorities of a data breach; and
- The obligations placed on data importers must be passed on to any further recipients of the personal data to ensure equivalent protections at all times.
For more information contact Jonathan McDonald and Olivia Crane.
Our thinking
Pei Li Kew
Pei Li Kew writes for Pharmacy Business on the link between pharmacy and IP
Pei Li Kew writes for Pharmacy Business on the link between pharmacy and IP
Jonathan McDonald
Announcement of a new Data Bill as part of the Queen's Speech
Jonathan McDonald
Jonathan McDonald provides comment for City AM on the Data Reform Bill announced in the Queen's Speech
Jonathan McDonald provides comment for City AM on the Data Reform Bill announced in the Queen's Speech
Nick White
Charles Russell Speechlys advises Symphony Holdings Limited on the sale of its PONY trade mark portfolio for USD $28 million
Charles Russell Speechlys advises Symphony Holdings Limited on the sale of its PONY trade mark portfolio for USD $28 million.
Simon Ridpath
Simon Ridpath featured in the Lawyer’s Hot 100 list
Simon Ridpath features in The Lawyer’s Hot 100 list
Natalie Batra
Patents and Peppa Pig: What is happening to intellectual property rights in Russia?
Certain Russian individuals and businesses can now use patents, utility models and industrial designs without obtaining prior permission.
Simon Green
International Bar Association quotes Simon Green on the future of the legal sector in Hong Kong
International Bar Association quote Simon Green on the future of Hong Kong's legal sector
Charlotte Duly
Charlotte Duly quoted in Retail Gazette on House of Zana trademark dispute
Charlotte Duly quoted in Retail Gazette on House of Zana trademark dispute
Caroline Greenwell
Nowhere to hide for greenwashing brands
In the UK, regulators are cracking down, with many companies now at risk of financial and other penalties.
Jamie Cartwright
Weighing up the Plastic Packaging Tax
The Plastic Packaging Tax came into force on 1 April 2022.
Jamie Cartwright
Crunching numbers - Mandatory calorie laws come into force
The Calorie Labelling (Out of Home Sector) (England) Regulations 2021 (the Regulations) are now in force.
Jody MacDonald
Liverpool FC’s Hero Club and the current state of play with football NFTs
Liverpool’s Hero Club hit the headlines this week and serves as an interesting reflection of the current state of play.
Rachel Bell
Rachel Bell commented in IT Pro on the implications of the proposed EU’s Digital Markets Act
The proposed EU’s Digital Markets Act is set to require larger messaging platforms to interoperate with their smaller rivals.
Quentin de la Bastide
Constructing a Blue-print for Electronic Execution – New Guidance from the Industry Working Group on the Electronic Execution of Documents
Sonia Kenawy
Claimant ordered to pay security for costs in cryptocurrency dispute and digital assets rejected as form of security
Proceedings that are sure to be watched closely by the cryptocurrency community as well as legal practitioners.
Stewart Hey
Freezing Orders: Policing the Nuclear Option (PT 2)
Looking at the impact these checks and balances have when it comes to drafting and construing the terms of the order.
Stewart Hey
Freezing Orders: Policing the Nuclear Option
This article considered some of the checks and balances that apply when seeking access to one of the law’s most potent weapons.
Jonathan McDonald
Jonathan McDonald and Ilona Bateson write for P3 Pharmacy on data protection compliance for pharmacy business owners
Health organisations hold more sensitive personal health data than ever.
Mark Hill
UAE Labour Law Update – The five big changes to note…
Federal Decree Law No. 33 of 2021 - The five big changes to note
Andrew Clarke
Charles Russell Speechlys advises Farfetch on its joint venture agreement with Clipper Logistics plc
Farfetch is a leading online luxury retail platform.