InsightsPublications

Share :

Standard Contractual Clauses - Q&A

We hereby inform you that the European Commission last month published the document "The New Standard Contractual Clauses - Questions and Answers," constituting a practical guide to the use of standard contractual clauses ("CCS"), suitable for regulating the transfer of personal data to and from countries located outside the European Economic Area.

Standard Contractual Clauses - Q&A

As previously reported in Alert No. 15/2021, on June 4th, 2021, the European Commission approved the new CCS models, which are intended to replace the former standard contractual clauses entered into earlier. Among the various critical issues that may arise on the subject here, we would like to point out the following:

MODALITIES FOR THE DRAFTING OF THE CCS

CCS guarantee four different types of transfers:

  • Module 1, transfer from data controller to data controller;
  • Module 2, transfer from data controller to data processor;
  • Module 3, transfer from data processor to data sub-processor;
  • Module 4, transfer from data processor to data controller.

Hence, the delegated CCS preparer will be required to:

  • select only those forms and options applicable to the case, depending on the type of personal data transfer, and delete from the document those forms and options that do not apply;
  • complete the text where necessary, e.g. by choosing the competent court and supervisory authority, as indicated in square brackets within the CCS;
  • insert information on processing within the annexes to the CCS.

TRANSFER IMPACT ASSESSMENT

Parties entering into CCSs must conduct an assessment regarding the impact of the transfer that documents in particular:

  • the specific circumstances of the transfer;
  • the laws of the country of destination;
  • the additional safeguards put in place to protect personal data.

In this process, it is suggested that the parties consider the specific circumstances of the transfer (e.g., categories of data, recipients, the economic sector etc...) and the applicable laws.

RELATIONSHIP BETWEEN SCC, ADEQUACY DECISION AND DATA PROCESSING AGREEMENT

If the transfer of personal data is governed by Module 2 and 3 above, the European Commission states that the parties are not obliged to enter into a separate data processing agreement, as these forms ensure compliance with both Article 28 GDPR and Article 46 GDPR.

If the transfer concerns a country subject to an adequacy decision, the exporter - to ensure compliance with Art. 28 GDPR - will have to use the so-called CCS for controllers and processors in the EU/EEA, as this case is assimilated to the transfer of personal data within the European Economic Area.

***

We would like to remind you that the prevailing standard contractual clauses will be considered valid until December 27th, 2022, therefore, by that date they will need to be replaced.