The BOE of 7 June 2021 published the European Commission's Implementing Decision of 4 June 2021, which published the new set of Standard Contractual Clauses or SCCs that represent a mechanism to ensure adequate data protection guarantees in international data transfers.
Among the main innovations of the new contractual clauses, it is important to highlight that they replace their predecessors that will cease to have effect as of 27 September 2021 and, furthermore, they are made up of four different models depending on the scenario in which they are used, including two previously unregulated scenarios (P-C and P-P):
- from controller to controller (C-C);
- from controller to processor (R-P);
- from processor to controller (P-C); and
- from processor to processor (P-P).
SCCs are tools commonly used by market operators to make international transfers of personal data to third countries that are not subject to an adequacy decision.
The previous SCCs were adopted before the entry into force of the General Data Protection Regulation (GDPR) and therefore needed to be updated. This need increased following the publication of the Schrems II judgment of the Court of Justice of the European Union (CJEU), which, although it considered them valid, concluded that in some cases they may not be sufficient to ensure an adequate level of protection.
The new clauses are fully adapted to the GDPR, incorporating the principle of "accountability” and making the criteria indicated by the CJEU in the Schrems II judgment their own. However, as indicated by the DPSA, it is still necessary for the exporter, if required, with the help of the importer, to analyse the impact that the legislation of the importer's country may have on the level of protection provided, so that it is essentially equivalent to that provided by the European framework. Also, it should be considered the guidelines of the European Data Protection Board on what additional measures are considered appropriate to ensure such an equivalent level of protection.
As indicated, the "old" contract terms will be repealed as of 27 September 2021. However, contracts concluded before that date under the old SCCs will be valid until 27 September 2022 (i.e. they will have a period of 15 months for adaptation to the new clauses), provided that the processing operations remain unchanged and the contractual clauses ensure that the transfer of personal data is subject to adequate safeguards.
Finally, it should be noted that following the publication of Commission Implementing Decision EU 2021/914 of 4 June 2021, we can only wait for the official translations of these clauses in the different official languages of the EU.