{"id":1752,"date":"2021-07-28T00:00:00","date_gmt":"2021-07-28T06:00:00","guid":{"rendered":"https:\/\/dev.epicsrv.com\/km\/european-commission-releases-new-standard-contractual-clauses-and-announces-compliance-deadlines\/"},"modified":"2025-12-15T10:51:25","modified_gmt":"2025-12-15T17:51:25","slug":"european-commission-releases-new-standard-contractual-clauses-and-announces-compliance-deadlines","status":"publish","type":"post","link":"https:\/\/www.kirtonmcconkie.com\/es\/news\/european-commission-releases-new-standard-contractual-clauses-and-announces-compliance-deadlines\/","title":{"rendered":"La Comisi\u00f3n Europea publica nuevas cl\u00e1usulas contractuales tipo y anuncia los plazos para su cumplimiento"},"content":{"rendered":"

Important update for organizations transferring personal data out of the European Economic Area (\u201cEEA\u201d).<\/strong><\/p>\n

Organizations with data ties to Europe will need to undertake significant efforts to meet quickly approaching deadlines based on recent announcements. On June 4, the European Commission published its long-awaited revisions to Standard Contractual Clauses (\u201cSCCs\u201d). A couple weeks later, on June 21, the European Data Protection Board (\u201cEDPB\u201d) issued the final version of its recommendations on supplemental safeguards, which contain essential guidance on the use of the new SCCs.<\/p>\n

The issuance of new SCCs and the publication of EDPB guidance significantly impact how US companies can transfer personal data outside of the EEA. The new SCCs replace the current SCCs, which many US companies have relied on for their cross-Atlantic data transfers. Organizations have until September 27, 2021, to begin using the new SCCs and must update all existing agreements with the new SCCs by December 27, 2022.<\/p>\n

Overview<\/u><\/p>\n

The adoption of the new SCCs and release of EDPB guidance come in the wake of the Court of Justice of the European Union (\u201cCJEU\u201d)\u2019s 2020 ruling in the Schrems II (C-3111\/18) case, which invalidated the EU-U.S. Privacy Shield, forcing companies to rely instead on SCCs or another approved mechanism for data transfers. If an organization has not updated its agreements since 2020 and they rely on the EU-U.S. Privacy Shield to transfer data, the company already faces legal risk.<\/p>\n

In addition to invalidating the EU-U.S. Privacy Shield, the European Court\u2019s ruling called into question the adequacy of the SCCs for data transfers to the U.S. The General Data Protection Regulation (\u201cGDPR\u201d) only allows for the transfer of EU personal data to a non-EU country when the parties have secured an adequate level of protection. Since the ruling, the European Commission has labored to create new guidance and SCCs that would adequately protect EU personal data.<\/p>\n

Highlighted Changes<\/u><\/p>\n

To address the CJEU\u2019s concerns as well as those raised by industry, the SCCs make a number of changes; they demand greater accountability and address additional possible data transfer scenarios.<\/p>\n

Adequacy and Other Concerns<\/em><\/p>\n

Under the EDPB\u2019s June 2021 guidance, parties must guarantee that the data importer can fulfill its SCC obligations under the country\u2019s laws where the importation will occur. The analysis involves a risk-based approach that requires the parties to document (1) the data transfer specifics, (2) the destination country\u2019s laws and practices, and (3) additional safeguards the parties decide to implement.<\/p>\n

The SCCs also require the data importer to notify the data exporter of any government access requests. When the country of import bars such notifications, the data importer must make every effort to obtain a waiver of the prohibition. In addition, data importers must assess whether they can legally challenge the government request for data. With these requirements, companies will want to ensure procedures are in place to respond appropriately to government data requests.<\/p>\n

Greater Customization <\/em><\/p>\n

The SCCs further allow for greater customization by using four modules and introducing new standard clauses.<\/p>\n

This approach creates different obligations for the parties based on the relevant data export scenario: controller-to-controller, controller-to-processor, processor-to-controller, and processor-to-processor. These permutations include a greater breadth of processor<\/em> scenarios than existed in the old SCCs.<\/p>\n

Moreover, parties choosing to use the SCCs will no longer need to enter a data protection agreement or addendum, since the SCCs satisfy the legal requirements of Article 28 in the GDPR. As a result, SCCs may become part of a larger agreement or may be supplemented by additional clauses if no contradictions exist with the materials accompanying the SCCs.<\/p>\n

The SCCs also introduce clauses that create greater flexibility and adaptability by:<\/p>\n