Standard Contractual Clauses (SCC)

Standard Contractual Clauses (SCC)

On 4 June 2021, the European Commission adopted the following:

COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council;

COMMISSION IMPLEMENTING DECISION (EU) 2021/915 of 4 June 2021 on standard contractual clauses between controllers and processors under Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council;

Those decisions was published in the OJEU on 7/6/2021.

The first decision contains as an annex the new Standard Contractual Clauses (SCCs) as required by the GDPR (Art. 46(2)(c) for data transfers from controllers or processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established outside the EU/EEA (and not subject to the GDPR). These new SCCs replace the three SCCs adopted under the previous Directive 95/46/EC. As of September 27, 2021, no more contracts incorporating the previous SCCs can be concluded.

According to Article 4(4) of the first Decision (914/2021), “Contracts concluded before 27 September 2021 on the basis of Decision 001/497/EC or Decision 2010/87/EU shall be deemed to provide appropriate safeguards within the meaning of Article 46(1) of Regulation (EU) 2016/679 until 27 December 2022, provided the processing operations that are the subject matter of the contract remain unchanged and that reliance on those clauses ensures that the transfer of personal data is subject to appropriate safeguards.”.