The Countdown Has Begun: By 26 December 2022, All Old Standard Contractual Clauses Must Be Replaced By The New SCCs 2021

• Published date: 28 October 2022
• Subject Matter: Privacy, Data Protection, Privacy Protection
• Law Firm: Taylor Wessing PartG mbB
• Author: Mr Wiebke Reuter and Paul Voigt

Background

The CJEU ruling in Schrems II (Case C-311/1) not only brought an end to the EU-US Privacy Shield, but also was the impetus for the European Commission to take on the task of issuing new standard contractual clauses ("SCCs 2021") – more than two years after the GDPR came into force.

Since June 2021, the old standard contractual clauses can no longer be used for new or modified data transfers from the EU to a third country. For existing data transfers, the European Commission had granted the parties a transitional period; this ends on 27 December 2022. As of this date, only the SCCs 2021 can be used to secure third country transfers (unless other justification mechanisms under the GDPR apply).

What steps do data exporters need to take now?

If not already done, data exporters should do the following:

• Identify data transfers to third countries.
• Determine which of these transfers are currently still safeguarded with the old SCCs.
• Contact data importer to initiate the conclusion of SCCs 2021.

What needs to be done in preparation for the conclusion of the SCCs 2021?

1. Determine "conclusion mode"

Unlike the previous standard contractual clauses, the SCCs 2021 follow a modular approach. This means that four different transfer scenarios are covered in one document:

• Module 1: Controller-to-Controller
• Module 2: Controller-to-Processor
• Module 3: Processor-to-Processor
• Module 4: Processor-to-Controller

The EU Commission expects from the parties to assemble individual contracts from the bundle depending on which module is applicable to their particular situation. If you want to save yourself this effort, you can use the Taylor Wessing SCC Generator.

Alternatively, it seems reasonable to include the SCCs 2021 "by reference" in a main contract. This approach gives the advantage that the entire (very long) contract does not have to be embedded in the main contract, but the standard contract clauses can simply be "referred to". It should be noted, however, that even in this case it must be made clear which module the parties want to conclude. Furthermore, a decision must be made regarding all optional clauses as well as the placeholders (see below). Thus, it is necessary that, in addition to the actual reference to the SCCs 2021, the required information must be provided, for example in the form of an annex to the main contract.

2. Selection on optional clauses

Clause 7 (Docking clause), clause 9 (Use of sub-processors) and clause 11 (Redress) of the SCCs 2021 contain optional clauses. Furthermore, one of the questions regularly emerging addresses the issue whether a liability clause can/should be included:

• Clause 7 allows for subsequent accession of additional...