EU-Approved GDPR Standard Contract Clauses: Mandatory Assessments, Affirmative Obligations of Data Importers

SCCs are template data transfer agreements that allow data exporters to transfer data to countries outside the European Economic Area (EEA) that the European Commission identifies as providing an "inadequate" level of data protection (including Australia, Brazil, China, India, and the U.S. The prior SCCs (approved by the Commission over a decade ago) are perhaps the most popular data transfer mechanism under EU data protection law. The new SCCs reflect requirements under the GDPR and the Schrems II decision of the EU's highest court.

Counsel should prepare to identify which European personal data flows (including those involving employees, customers, suppliers, and affiliates) will be impacted, whether SCCs are necessary under the GDPR, and whether and who must comply with the (rigorous) obligations under the SCCs. Counsel must also assess whether, under Schrems II, the laws of the country where the data is imported (mainly U.S. law) are consistent with the SCCs and the EU law in general (including the Charter of Fundamental Rights of the EU and the GDPR) and if any "supplementary measures" are necessary to boost data protection.

U.S. and non-EU-based businesses must comply with the provisions requiring appropriate "transfer diligence" on customers and suppliers concerning data transfers. Counsel should work with companies to identify relevant contracts with customers, suppliers, and affiliates.

Listen as our expert panel addresses what the new SCCs mean for continued business in the EU and beyond. The panel will discuss best practices in updating contracts and policy provisions to comply with these standards.