Series
Blogs
Series
Blogs
The deadline to repaper legacy EU standard contractual clauses is the 27 December. We reflect on some of the lessons from this great repapering exercise.
In June last year, the EU Commission issued their long-awaited new Standard Contractual Clauses (“SCCs”) for the transfer of personal data to third countries. The clauses included a number of innovations such as building in transfer impact assessments (“TIAs”) and operating in a modular way with a new option for processor-to-processor and processor-to-controller transfers (more here).
As part of a carefully worked out transition process, new transfers could still be made under the old SCCs until September 2021 and, absent any changes to the processing in the meantime, existing transfers could be made under the old SCCs until 27 December 2022. The latter deadline is now upon us. Merry Christmas.
Many businesses have either completed, or are close to completing, this repapering exercise. In our experience, this has typically involved two concurrent phases.
The first phase is to understand and rationalise affected data transfers. In some cases, this is easier said than done. After nearly twenty years of the old SCCs, it is not necessarily easy to track down where they are used within a business, let alone confirm if the transfers described in the SCCs are still with the same counterparty, still correctly described, still actually taking place etc.
This initial process also typically seeks to rationalise the use of SCCs wherever possible. In particular, the new processor-processor module can hugely simplify some data transfers by allowing an EU-based supplier entity to act as a single point of contact (i.e. it gets rid of any arguable need for direct SCCs between controllers and a supplier’s sub-processor).
The second phase is to carry out the actual repapering. This typically requires:
Like Tolstoy’s unhappy families, each business will have approached this in their own way. The number of transfers, the type of data being transferred, the jurisdictions to which data is transferred, and the homogeneity of the transfers; these all affect the overall approach to this exercise.
However, our experience suggests there are four key factors to a successful repapering exercise:
Following Brexit, the UK is running on its own timelines. While the deadline to switch to the new IDTA or UK SCC addendum passed in September this year, existing transfers can continue under the old SCC until March 2024 (assuming the processing doesn’t change).
The UK Information Commissioner has also issued new guidance on international transfers, including an alternative six stage approach to conducting TIAs. It is open to UK controllers to use either the EU or UK approach, but those using the UK approach will likely benefit from some additional flexibility given it focuses more closely on the inherent risk in the data being transferred. For example, if all the data is “Low Risk” (e.g. name, age, contact details, training records) it can proceed without a substantive assessment of the jurisdiction to which it is being transferred. However, for large organisations processing sensitive data the process is likely to be very similar, if not identical, to the EU approach, and there are likely to be process and cost benefits in explicitly applying the EU approach to UK transfers.
8 December 2022
Up next