Finally....European Commission issues new draft standard contractual clauses
The European Commission has issued a draft of its long-awaited revised standard contractual clause model contract (SCC). The current SCCs pre-date the GDPR and so the revised draft is both welcome and overdue. The draft is currently subject to a 4 week consultation period and businesses are invited to submit their comments. It remains to be seen what the final version will look like although it is unlikely to materially deviate from the draft.
Some initial comments to consider:
Modules : the new draft is split into 4 modules, covered controller to controller, controller to processor, processor to processor and processor to controller. The latter two modules are a welcome addition and address a fundamental gap in the previous documents;
Schrems II : following the recent court decision on the validity of privacy shield etc, the new draft also contains provisions placing obligations on the parties to warrant "that they have no reason to believe that the laws in the third country of destination.......prevent the data importer from fulfilling its obligations". Whilst it is unknown whether this was included pre or post the Schrem II decision, it further emphasizes the EC message that the SCCs are not just a tick box exercise and continual monitoring and validation will be required;
GDPR alignment : the most notable (and obvious) changes are in the SCC alignment with the GDPR. There are, for example, numerous references and provisions relating to transparency and security which are cornerstones of the GDPR.
We will issue a review of the key changes once the consultation period has ended and we have the final version. In the meantime if you want to contribute to the consultation or read the revised model then these can be found at :
Comments