On June 4th, the European Commission has announced the adoption of the long-awaited new Standard Contractual Clauses (SCCs). The model contracts are intended to facilitate cross-border transfers of personal data between entities within the European Union (EU) plus Norway, Iceland and Liechtenstein (altogether, the European Economic Area, EEA), to entities in other countries (so-called third countries). In addition to the SCCs for international transfers, the Commission has also adopted model clauses that can be used as part of a data processing agreement with an EU entity, as required under Article 28 GDPR.
Scope and content of the international transfer SCCs
The new SCCs intended for international transfers are based on four scenarios: controller-to-controller, controller-to-processor, processor-to-processor and processor-to-controller. In addition, the model clauses contain a so-called docking clause, allowing parties that are joining the processing operation to be part of the same contract, instead of signing a whole range of individual agreements with organizations. This could for example be useful if multiple legal entities of a controller or processor need to be part of the contract.
By using the SCCs, organisations can ensure that their data transfers meet the basic requirements of the EU’s General Data Protection Regulation (GDPR) and that the necessary “appropriate safeguards” are in place. This includes requirements on transparency towards the data subject, as well as provisions on dealing with individual rights and regulator requests. The “regulator” refers to one of the European data protection authorities (DPAs) – the clauses must stipulate which of the DPAs will be responsible to oversee a particular data transfer. The SCCs furthermore deal with the key data protection principles of the GDPR, including data minimisation, data security, and accountability. ..
Support the originator by clicking the read the rest link below.
