Privacy – New SCC’s

Posted the 27 September 2021
Previous Next
Our latest DEL-Law newsletter re the entry into force on 27 September 2021 of the Commission implementing decision (EU) 2021/914 of 4 June 2021 adopted in the aftermath of the Schrems II ruling of the ECJ and setting out new standard contractual clauses (SCC’s) for international transfer of data pursuant to the GDPR (Regulation (EU) 2016/679. Happy to assist with the burdensome implementation of those far more stringent clauses.

On 27 September 2021, the Commission implementing decision (EU) 2021/914 of 4 June 2021 adopted in the
aftermath of the Schrems II ruling of the ECJ and setting out new standard contractual clauses (SCC’s) pursuant to
the GDPR (Regulation (EU) 2016/679, enters into force. Following, as from 27 September 2021, the new set of SCC’s
has to be used to ensure appropriate data protection safeguards within the meaning of Article 46(1) of the GDPR for
international data transfers to countries that do not provide an “adequate” level of protection for personal data
instead of the former SCC’s of 2001, 2004 and 2010 based on the Directive 95/46. Obviously when one does not rely
on other mechanism or an exception for the transfer. Contracts concluded before 27 September 2021 using the
former SCC’s shall however remain valid until 27 December 2022.
By way of remainder, the new SCC’s have to be applied in line with the Recommendations 2020/01 issued on 11
November 2020 by the European Data Protection Board on measures that supplement transfer tools to ensure
compliance with the EU level of protection of personal data.
The new SCC’s that entails a modular non-negotiable 4 sets approach provides additional requirements to ensure
adequacy including the obligation for the parties to apply additional transparency and notification controls covering
government access requests, and to carry out and document an assessment of the laws of the third country to
confirm said laws do not prevent the importer’s compliance with the terms in the SCCs, taking into account with
the factual circumstances of the transfer and any additional safeguards adopted. In particular the parties have to
warrant that they have no reason to believe that the laws and practices in the country of destination prevent the
importer from complying with its obligations under the new SCCs. If a change in law no longer guarantees adequacy,
the data exporter has to suspend the transfer and may terminate the contract.
Also to note the extended scope of application, the multi-parties docking system, the direct rights granted to data
subjects, the replacement of data processing agreements or the liability system set up by the SCC’s.
The new SCC’s do not apply to the UK non-EU transfers.
DEL-Law’s team stand ready to assist you with this rather stringent requirements.

Related articles


Covid and telework in Brussels

Thanks to a record vaccination rate of 70%, Belgium has eased its health restrictions as of 1st September 2021. Allowing the return to the office and face-to-face meetings. Indeed the telework – that was no longer mandatory since 27 June...

Ministerial Decree COVID

The latest version of the Ministerial Decree (MD) of 28 October 2020, as amended by MD of 26 March 2021, maintains mandatory teleworking, except for essential sectors or when the nature of the function or the continuity of management prevents...

CLA 149 Teleworking

The National Labour Council concluded the collective labour agreement (CLA) 149 on 26-1-2021 on recommended or mandatory telework due to Covid. This CLA is suppletive, applying only to companies that do NOT have existing agreements on structural (CLA 85) or...