Do you transfer data between the EU/ EEA and other countries? If you do, now is the time to check that your Standard Contractual Clauses are up to date.

Just remind me...what are Standard Contractual Clauses? These are model (template) contracts prepared by the European Commission. An important mechanism for EU/EEA businesses to be able to operate internationally, they're used to ensure appropriate data protection safeguards for data transfers from the EU/EEA to third countries who don't possess an adequacy decision.

What's an adequacy decision? Based on article 45 of the GDPR (General Data Protection Regulation), an adequacy decision is a formal recognition from the European Commission. It confirms that another country provides a level of legal protection for personal data equivalent to that of the EU.

Which countries have adequacy decisions? The current list of those countries is: Andorra, Argentina, Canada (only commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, Japan, the United Kingdom, and South Korea.

So, Standard Contractual Clauses are important for international data transfer between the EU/ EEA and countries without an adequacy decision? Yes. For example, the USA.

But why do Standard Contractual Clauses need checking now? That's because an important deadline is looming. The European Commission issued a new set of Standard Contractual Clauses on 4 June 2021. If you haven't implemented those updated clauses already, the deadline for doing so is 27 December 2022.

Why are the new versions needed? The new set of Standard Contractual Clauses replace previous versions that were drafted both before the GDPR - the EU regulation on data protection and privacy - and before recent decisions from the Court of Justice of the European Union on international transfer of data. This means that the old versions were not entirely appropriate for the exchange of personal data between the EU/EEA and third countries.

What happens if I don't update my Standard Contractual Clauses? The EU will not recognise your contract as grounds for data transfers from the EU/EEA to the USA or to other third countries. As you will no longer be able to rely on your contract for those transfers you may find yourself in breach of the GDPR.

Want cross-border legal and compliance advice? Contact Nazareth & Partners.

At Nazareth & Partners, we provide legal and compliance advice for professional employer organisations and staffing companies around the world. If you want advice on any point of cross-border employment law, contact us, today.