The European Commission is planning a significant revision of the Standard Contractual Clauses (SCCs) that govern international data transfers. These new regulations are expected to come into force in 2025 and respond to current challenges posed by global data exchange and the General Data Protection Regulation (GDPR).
Why the changes are necessary
The existing SCCs cover many international data transfer scenarios, but they reach their limits when it comes to the exchange of personal data between companies that are both subject to the GDPR but located in different countries. The European Data Protection Board (EDPB) already emphasized the need to close this gap in 2021. There are uncertainties, particularly in the case of data transfers to third countries, mainly due to the potential risk of government access to data and difficulties in enforcing data protection rights.
Key adjustments in the new SCCs
- Regulations for GDPR-compliant companies outside the EU: The new SCCs should explicitly address cases in which both the data exporter and the data importer are subject to the GDPR regulations, even if they are located in different jurisdictions. This applies in particular to data transfers between EU companies and those in third countries that are subject to the GDPR.
- Consideration of third country risks: A key objective of the new regulations is to mitigate the risks associated with data transfers to third countries. This includes access by governments in third countries and the difficulty of enforcing data protection claims there. The new SCCs will regulate the handling of such risks to a greater extent.
- More flexible clauses for companies: The revision will also mean that the new SCCs will be more flexible for businesses to apply in order to accommodate different legal and contractual requirements. It is expected that the new clauses will allow companies to better hedge individual risks without violating the GDPR.
Public consultation and introduction
The EU Commission plans to discuss the new SCCs in a public consultation in the fourth quarter of 2024 to gather feedback from stakeholders, companies and data protection authorities. This consultation is important to ensure that the new rules are both legally and practically meaningful and applicable. The final SCCs are expected in 2025 and will then apply to all international data transfers within and outside the EU.
Sources:
• EU-Kommission: https://commission.europa.eu
• Steptoe LLP: https://www.steptoe.com
• DataGuidance: https://www.dataguidance.com