European Commission publishes new draft Standard Contractual Clauses for consultation

Hot on the heels of the EDPB’s guidance on ‘supplementary measures’ with respect to international data transfers as a result of the Schrems II judgment (for further details see our blog post here), the European Commission has now published its long-awaited draft new Standard Contractual Clauses (the “New SCCs”) for consultation.

Legal Background

Chapter V of the GDPR prohibits the transfer of personal data out of the EEA to a third country or international organisation unless one of a number of available conditions under the GDPR is satisfied.

One of the conditions most often relied upon to legitimise the international transfer of personal data is use of the so-called Standard Contractual Clauses (“SCCs”). These are effectively a contract entered into between the data exporter and the data importer and impose certain data protection obligations on both parties. There are currently two different sets of SCCs which have been approved by the European Commission to cover transfers from: (i) a controller to another controller; and (ii) a controller to a processor.

However, the existing SCCs did not get updated when the GDPR came into force and so still refer to the old EU Data Protection Directive rather than the GDPR. There has also been criticism of the SCCs for a number of reasons, including because they don’t cover processor to processor transfers, leaving organisations the difficult task of trying to fit a square peg into a round hole when it comes to transfers from an EEA processor to a non-EEA sub-processor. The recent Schrems II case (see our blog post on the case here) also raised the question of whether or not contractual ‘supplemental measures’ are required when using the SCCs in order to further protect personal data being sent to countries which don’t otherwise provide adequate protection.

The New SCCs have therefore been eagerly awaited.

In this blog post we ‘summarise’ some of the key changes (both good and bad) and what they could mean for organisations and international data flows. With apologies for the length of this post, there is (fortunately or unfortunately) quite a lot to comment on! We have tried to limit our comments below to some of the more ‘big ticket’ issues. However, as always the devil is in the detail and there is an awful lot of detail with devils in it.

Grace period

The New SCCs contemplate a one year grace period for implementation, from the date of the European Commission’s implementing decision. Whilst this may seem positive in contrast to, for example, the ECJ’s decision in the Schrems II case to invalidate the EU-US Privacy Shield with immediate effect, it is important to note that the one year grace period applies because the New SCCs will repeal the existing clauses, meaning that organisations will have no choice but to re-paper their contracts to put the New SCCs in place. See further our ‘repapering’ section below.

Structure

The New SCCs adopt a modular format, allowing organisations to include or exclude particular modules depending on the factual scenario in question. Whilst at first blush, this appears to be a sensible and perhaps surprisingly flexible approach, it does appear to result in a particular sting in the tail as it means that it is not easily possible to ‘rip and replace’ and swap out the SCCs with the New SCCs. See further our ‘repapering’ section below.

Scope (data transfers)

As mentioned above, the SCCs only cover controller to controller (“C2C”) transfers or controller to processor (“C2P”) transfers. This created significant hurdles when an EEA controller was transferring data to an EEA processor who then wanted to onwards transfer to a non-EEA sub-processor, as there were no processor to processor (“P2P”) clauses available. In addition, since implementation of the GDPR, it has been unclear how the SCCs were supposed to apply in the context of a non-EEA controller subject to the GDPR as a result of the extra-territoriality provisions in Article 3. The SCCs only contemplated controllers/exporters located in the EEA.

The New SCCs contemplate all transfer scenarios, being C2C, C2P, P2P and even processor to controller (“P2C”). They also contemplate transfers where the data exporter is located outside of the EEA. This extended scope is likely to be good news for organisations who have long struggled to make the existing scope fit for purpose in the context of complex supply chains.

Scope (processor clauses)

As well as updating the SCCs for international data transfer purposes, the European Commission has also used the opportunity to incorporate into the New SCCs a set of processor clauses required by Article 28 GDPR. The GDPR mandates the inclusion of certain provisions in contracts between controllers and processors so, once again, at first blush it seems absolutely sensible to include such provisions in an international data transfer contract between a controller exporter and a processor importer.

However, the Article 28 provisions in the New SCCs are not a ‘module’ in and of themselves, meaning they cannot easily be extracted. In addition, the New SCCs make it clear that, in the event of a conflict between the provisions of the New SCCs and the provisions of any other agreement between the parties, the terms of the New SCCs will prevail. For organisations who have spent significant time and resource over the last 2-3 years negotiating data protection provisions into their commercial contracts, it is unlikely to be welcome news to understand that at least some of those negotiated positions may be superseded by the version of Article 28 that the European Commission has decided to incorporate into its New SCCs. See also our ‘liability’ section below.

Extending the extra-territorial reach of the GDPR?

The New SCCs (in the C2C module) contain an interesting requirement for non-EEA data importers who are controllers to notify the competent EU supervisory authority of any personal data breach likely to result in ‘significant adverse effects’. This would apply even to a non-EEA controller not otherwise subject to the GDPR, therefore extending the extra-territorial reach of the GDPR even beyond Article 3(2). In addition, the threshold is ‘significant adverse effects’ rather than the thresholds referred to in the GDPR. Thresholds aside however, this is likely to be a challenging obligation for controller importers who would otherwise have no interaction or relationship with any EU supervisory authority.

Schrems

It was almost inevitable that the New SCCs would include provisions to try and deal with some of the challenges brought about by the Schrems II case. Indeed, many commentators have suggested that the reason it has taken the European Commission such a long time to publish the New SCCs is because it wanted to be able to publish a version which responded to the Schrems case. It is therefore not surprising that the New SCCs include ‘supplementary measures’ to address concerns about the transfer of personal data to countries which don’t provide adequate protection.

The Schrems-related provisions in the New SCCs include: (i) a warranty from the parties that they have no reason to believe that the laws in the importer country prevent the importer from fulfilling its obligations under the New SCCs; (ii) a requirement to assess the laws of the importer country; (iii) a requirement to document the assessment referred to in (ii); and (iv) a requirement to make the documented assessment available to a competent supervisory authority on request. In addition, there are obligations on the data importer to challenge requests for access received from an authority and only provide the minimum amount of personal data possible once such challenges have been exhausted.

These types of obligations are a fairly logical consequence of the Schrems judgment but they are nonetheless onerous on the parties to the transfer. For small/medium data importer organisations in particular, the requirement to exhaust legal challenges in response to access requests is likely to be expensive and challenging. Similarly, the requirement on data exporters to assess the relevant laws in the importing country appears to place an obligation on private sector companies that the European Commission itself hasn’t been able to discharge other than with respect to a handful of countries that have obtained an adequacy decision. The final sting in the tail here would also appear to come in the form of the recently published EDPB Schrems guidance which suggests that contractual supplementary measures are nonetheless unlikely to enable a data exporter to transfer data to a third country that does not have essentially equivalent laws (i.e. the inclusion of these clauses in the New SCCs could make no difference whatsoever to the ability of a data exporter to transfer the data in a compliant manner).

Repapering (again)

As mentioned several times above, there appears to be no escaping the fact that the New SCCs are going to require every single organisation in Europe that transfers data outside of the EEA to undertake a mass repapering effort. Coming so soon after data protection repapering exercises undertaken to deal with: (i) the invalidation of the Safe Harbor; (ii) the implementation of the GDPR; (iii) the invalidation of the EU-US Privacy Shield; and (iv) the upcoming expiry of the Brexit transition period, this is likely to be particularly unwelcome news. The prospect of asking for additional budget to undertake such an exercise is also unlikely to be particularly appetising for many privacy professionals within organisations.

However, the modular structure of the New SCCs means that a simple ‘rip and replace’ for existing SCCs in unlikely to be possible. In addition, the introduction of P2P and P2C clauses will require the papering of new relationships as these clauses didn’t exist previously.

As well as the administrative burden of a repapering exercise though, it appears that this latest project is also likely to require more careful legal analysis than those that went before it. The interplay between commercially negotiated C2P positions and the provisions in the New SCCs will need to be carefully considered to understand the extent to which existing positions conflict with the New SCCs. There will also likely end up being a divergence between the processor terms negotiated between controllers and processors based in the EU, and those negotiated between controllers in the EU and processors outside of the EEA. In summary, it won’t be simple.

Liability

It perhaps follows on from the point above regarding potential conflict between negotiated commercial positions and the New SCCs that the issue of liability is likely to become a particular sticking point. The New SCCs contain more detailed liability provisions than are currently set out in the SCCs, and many organisations will already be aware of the complex negotiations undertaken commercially with respect to processor liability in particular. For example, the interaction between commercial agreed liability caps and the ‘uncapped’ liability position in the New SCCs is unclear – would an agreed liability cap be viewed as being in ‘conflict’ with the position in the New SCCs?

Conclusions

The New SCCs are not all bad news. It is clear that the European Commission has tried to address many of the criticisms of the existing clauses with its new drafting and flexible modular structure. However, regardless of whether or not the drafting has been improved, the fact that their implementation will require yet another resource-heavy and expensive repapering exercise is possibly a disadvantage that many will consider outweighs any possible benefit. In combination with the recent EDPB guidance on Schrems, it seems to make for a rather bleak outlook for organisations trying to balance data protection compliance with the commercial reality of global data flows.