For a more detailed analysis of the recently published Recommendations, and practical advice for the next steps that businesses can take, please click here.

On November 12, the day after the EDPB published its Recommendations for consultation, the Commission published a draft Implementing Decision attaching drafts of the long-awaited new Standard Contractual Clauses (SCCs). The new SCCs incorporate general clauses applicable to all scenarios and then wording in separate modules to cater for the different relationships. That modular wording addresses the relationships missing under the current Clauses (processor to controller, and processor to processor) and will need to be tailored in the case of each use by choice of the applicable module. The modules are flexible enough to cover even the transfer from a non-EEA processor to a non-EEA sub-processor. Furthermore, the Commission points out, it should be possible for more than two parties to adhere to one set of SCCs, which may reduce paperwork in complex structural arrangements.

Following the Schrems II decision by the CJEU, the new SCCS make provision for how the parties should act when one is unable to comply with the SCCs due to supervening disclosure requests by an ex-EEA authority “and in particular how to deal with binding requests from public authorities in the third country for disclosure of the personal data transferred”. The draft incorporates some of the supplementary safeguards recommended by the EDPB on this point.

Businesses will have a transition period of 12 months from the date of adoption of the Decision to replace existing SCCs with the appropriate new version(s). The draft SCCs are open for public consultation until December 10, 2020, and feedback may be submitted here. Links to the draft Decision and the draft SCCs appear on the feedback page.