As the September 27th deadline to implement the new Standard Contractual Clauses (“SCCs”) approaches, many privacy practitioners are working overtime to help their clients update their standard data processing addenda to facilitate the lawful transfer of personal data from the EEA to non-adequate countries (“third countries”).
Practitioners looking to facilitate transfers of personal data from EEA-adjacent countries like the United Kingdom and Switzerland, however, will need to look beyond the June 4th European Commission Implementing Decision. For those countries, which have their own privacy laws and regulators, the new SCCs, on their own, will not facilitate the lawful transfer of personal data to third countries like the United States.
To help bridge the gap, the the UK Information Commissioner’s Office (“ICO”) and the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) both recently published updates on the intersection between their respective privacy laws and the GDPR in the context of international data transfers. This post summarizes those updates.
The ICO’s Approach
Since early May, the ICO has been working on “bespoke UK SCCs” to facilitate transfers of personal data from the UK to third countries post-Brexit. In the meantime, parties could continue to use the old EU SCCs as their transfer mechanism.
Then, on August 11, the ICO published a draft International Data Transfer Agreement (“IDTA”) and a draft UK Addendum to the new SCCs for public consultation. The IDTA is intended to serve as a stand-alone contract for restricted transfers of personal data to a country outside the UK. The UK Addendum, by contrast, allows UK data exporters to use the new SCCs so long as they append the UK addendum—which modifies the EEA SCCs to align them with UK data protection laws as they apply to data transfers from the UK. Among other things, the draft UK Addendum states that all references in the new SCCs to the GDPR should be replaced with references to “UK Data Protection Laws,” the supervisory authority should be the ICO, and disputes arising from the new SCCs (including legal proceedings brought by a data subject) must be resolved by the courts of England and Wales.
But because the IDTA and the UK Addendum have not yet been finalized or formally adopted (the ICO’s public consultation period closes on October 7, 2021), the old SCCs remain the only contract-based transfer mechanism that has been blessed by the ICO. As a result, until the UK Addendum is finalized and approved, companies seeking to cover transfers from the EEA and the UK to third countries will need to implement both the new and old SCCs.
The Swiss FDPIC’s Approach
On August 27, the Swiss FDPIC announced that it will recognize the new SCCs as a basis for the transfer of personal data to third countries—with a caveat. The new SCCs must be “adapted and/or supplemented as necessary in specific cases” to account for the application of the Swiss Federal Act on Data Protection (“FADP”). To determine the necessary adjustments to the new SCCs, the FDPIC instructs Swiss data exporters to take the following steps:
In short, although properly addressing Swiss data transfers will be a bit complicated, the upside is the parties can still use the new SCCs as their framework for those transfers—unlike for UK-originating transfers (at least for now).
The Bottom Line
The bottom line is that parties seeking to address transfers from the UK and Switzerland as well as the EEA will have to think twice before just using their copy-and-paste skills to implement the new SCCs. At least for now, when those UK and Swiss transfers are in scope, parties will need to take additional steps to adapt their contracts to account for those countries’ unique transfer requirements.
See more »
DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
© Wyrick Robbins Yates & Ponton LLP | Attorney Advertising
Refine your interests »
Back to Top
Explore 2022 Readers’ Choice Awards
Copyright © JD Supra, LLC