For the last two weeks, the new standard contractual clauses (SCC) of the European Commission can be used for cross-border transfers of personal data. However, many companies are still struggling with them. In the meantime, large projects have been started in other companies to review and adapt all contracts with the old clauses. The “old” clauses may only be entered into until September 27, 2021.
Comprehensive FAQ on the topic
Using the new SCC is much more complicated and cumbersome than using the previous ones. Unfortunately, it is also not possible to simply replace annexes with the old clauses with annexes containing the new ones. Moreover, many questions arise as to how and where the new SCCs will be used and what consequences they have - for example, for international data transfers to non-whitelisted third countries such as the US.
In a comprehensive FAQ on the new EU Standard Contractual Clauses (SCC) David Rosenthal now addresses them. Over 60 pages, he provides concrete, practical answers to all the questions that have reached us so far or that we have encountered ourselves. The FAQ also deals with the use of the new SCCs under Swiss law - even though the Federal Data Protection and Information Commissioner has not yet commented on them.
Intra-Group Data Transfer Agreement, adaptation of old contracts
We have also started to upgrade the Intra-Group Data Transfer Agreements (IGDTA) of various clients to the new standard. IGDTAs which are nowadays de facto mandatory for all groups of companies whose units exchange personal data with each other - even if data only flows within Europe (e.g. if the group's mail server is operated centrally).
Contact us if your company is also part of a group of companies and you do not yet have an IGDTA in place, if your existing IGDTA is not yet in the process of being adapted to the new SCC or if you still have other contracts with the old standard contractual clauses. These will have to be adapted in the near future. Since we are currently making such adjustments for various companies, all our clients can benefit from lower costs.
That said, there is no immediate need for action if you are only dealing with large providers such as Microsoft or Salesforce.com and are not part of a group of companies. In this case, we generally recommend waiting until these providers offer you contract adjustments on their own initiative.
Further recommendations on how to proceed can be found in question 45 of the above FAQ.
Author: David Rosenthal
VISCHER Data & Privacy Team
