Greindl & Köck

Old Standard Contractual Clauses for third country transfers are about to expire

Websites and apps tend to use cookies to obtain and process the personal data of users. The providers of such services are often companies based in the USA or other third countries (outside the EU and EEA). The transfer of personal data to these companies is therefore a “third country transfer” according to the provisions of the GDPR.

This is the case, for example, when using statistics tools, such as Google Analytics, which processes personal data to analyse website performance. However, the same often applies to other popular services such as clouds, WhatsApp, Facebook and Zoom.

According to the provisions of the GDPR, such third-country transfers are only permitted if it can be ensured that the personal data are adequately protected. One way to ensure the appropriate level of data protection is to use the Standard Contractual Clauses (SCCs) adopted by the EU Commission, which can form the legal basis for third country transfers.

 

“New” SCCs:

The “old” SCCs from 2010 expire on 27.12.2022 and may no longer be used. As such, Companies have to use the updated SCCs published by the EU Commission on June 4th, 2021 or adjust existing agreements.

According to the new requirements, a Transfer Impact Assessment must also be carried out before the third country transfer in order to assess whether an adequate level of data protection exists according to the legal situation in the target country.

 

Potential fines:

Third country transfers that still take place after December 27th, 2022 on the basis of the old SCCs violate the GDPR. In this case, pursuant to Article 83 para 5 lit. c GDPR, a fine of up to EUR 20 million or 4% of the total worldwide annual turnover could be imposed.

It is therefore advisable to re-examine the legal basis on which third country transfers take place and check whether the new SCCs are used or if any other legal bases to cover the data transfer need to be examined.

 

 

The current versions of the SCCs can be found here:

Standard contractual clauses for international transfers | European Commission (europa.eu)