Based on the principles in the Court of Justice Schrems II judgement of 16 July 2020, with Decision no. 2021/914 of 4 June 2021, the European Commission has approved two new sets of Standard Contractual Clauses (“SCCs“) which, from 27 September, must be included in contracts to regulate a transfer of personal data to non-EU countries or international organisations. For contracts signed before this date, there will be a transition period ending on 27 December 2022, provided that the processing operations covered by the contracts remain unchanged and the “old” clauses ensure that the transfer of personal data is subject to adequate safeguards. After this deadline, these contracts will need to be updated based on the new SCCs. The new SCCs will cover cases where personal data is transferred to non-EU countries or international organisations that do not offer a system of protection equivalent to that provided by the Data Protection Regulation (EU) 2016/679 (the “GDPR“). The new SCCs must be adopted for personal data transfers: (i) between data controllers; (ii) between a controller and its processor; (iii) between a processor and its (sub) processor; and (iv) between a processor and its controller where the latter is not subject to the GDPR scope.
Other related insights:
