07.10.2021

Passing personal data across borders – new EU decisions

Michał Czuryło

June 4, 2021. The European Commission has published two implementing decisions – No. 2021/915 and No. 2021/914 – containing two sets of new contractual clauses. The case concerns the transfer of personal data to third countries outside the European Economic Area. Under the new rules, it is no longer possible to use the old standard contractual clauses after 27 September 2021. In addition, data transfers based on them have to be brought into line with the new legal status by December 27, 2021.

What is changing?

The first Commission Decision replaces the previously used Decisions 2001/497/EC and 2010/87/EU on cross-border data transfers to third countries. The purpose of the second set of clauses, on the other hand, is related to the needs of information flows between data controllers and processors.

Thus, the new standard clauses are divided into data transfers:

  • between controllers;
  • between a controller and a processor;
  • from a processor to another processor;
  • from a processor to a controller.

Importantly, the ability to interfere with the content of the new standard contractual clauses adopted by the European Commission is very limited. In particular, they may be supplemented with provisions on additional data processing safeguards and a clause on the applicable law.

The previous standard contractual clauses were based on the provisions adopted in implementation of Directive 95/46/EC of the European Parliament and of the EC Council of 1995. When RODO started to apply in May 2018, the clauses were not updated. Earlier Commission decisions did not specifically address data transfers between processors and from processors to controllers. Therefore, when such data flows occurred between the entities involved, this resulted in significant practical and legal difficulties.

Transitional periods

The Commission’s decisions came into force on 27 June 2021. In contrast, the previous contractual clauses were repealed with effect from 27 September 2021. This means that during the aforementioned transitional period, businesses had the option to enter into contracts under either the old or new standard contractual clauses.

For contracts governing transfers of personal data to third countries based on the old contractual clauses, a transitional period of 18 months was introduced, which applies until 27 December 2022. By that date, all existing data transfers outside the European Economic Area will have to be regulated under the new standard of contractual clauses.

 

Do you want to be up-to-date? Subscribe to our newsletter!

The Foundation conducts legal publishing activities free of charge

Do you want to be up to date? Sign up for our newsletter

By subscribing to our newsletter, you consent to the sending of information by e-mail on important events in the field of law, legislative changes and the activities of the Law Firm.

read more

The administrator of your personal data is KWKR Konieczny Wierzbicki i Partnerzy S.K.A. with headquarters in Krakow, ul. Kącik 4, 30-549 Krakow. Your data will be processed for the purpose of sending our newsletter. You have the right to request access to your personal data, their copies, rectification, deletion or limitation of processing, as well as the right to object to the processing and to lodge a complaint with the supervisory authority. More details can be found in our Privacy Policy.

Contact

KWKR Konieczny Wierzbicki and Partners Law Firm
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Administratorem Twoich danych osobowych jest KWKR Konieczny Wierzbicki i Partnerzy S.K.A. z siedzibą w Krakowie, ul. Kącik 4, 30-549 Kraków.
Przetwarzamy Twoje dane wyłącznie w celu udzielenia odpowiedzi na wiadomość przesłaną przez formularz kontaktowy i dalszej komunikacji (co stanowi nasz prawnie uzasadniony interes) – przez czas nie dłuższy niż konieczny do udzielenia Ci odpowiedzi, a potem przez okres przedawnienia ewentualnych roszczeń. Masz prawo do żądania dostępu do swoich danych osobowych, ich kopii, sprostowania, usunięcia lub ograniczenia przetwarzania, a także prawo wniesienia sprzeciwu wobec przetwarzania oraz wniesienia skargi do organu nadzorczego. Więcej szczegółów znajdziesz w naszej Polityce Prywatności.
Warszawa

Rondo ONZ 1,

00-124 Warszawa

+48 12 3957161

kontakt@kwkr.pl

Chcesz być na bieżąco? Zapisz się do naszego newslettera

Zapisując się do naszego newslettera wyrażasz zgodę na przesyłanie drogą e-mail informacji na temat istotnych wydarzeń z dziedziny prawa, zmian legislacyjnych oraz działalności Kancelarii.

czytaj więcej

Administratorem Twoich danych osobowych jest KWKR Konieczny Wierzbicki i Partnerzy S.K.A. z siedzibą w Krakowie, ul. Kącik 4, 30-549 Kraków. Twoje dane będą przetwarzane w celu wysyłki naszego newslettera. Masz prawo do żądania dostępu do swoich danych osobowych, ich kopii, sprostowania, usunięcia lub ograniczenia przetwarzania, a także prawo wniesienia sprzeciwu wobec przetwarzania oraz wniesienia skargi do organu nadzorczego. Więcej szczegółów znajdziesz w naszej Polityce Prywatności.

 

Do you want to be up to date? Sign up for our newsletter

By subscribing to our newsletter, you consent to the sending of information by e-mail on important events in the field of law, legislative changes and the activities of the Law Firm.

read more

The administrator of your personal data is KWKR Konieczny Wierzbicki i Partnerzy S.K.A. with headquarters in Krakow, ul. Kącik 4, 30-549 Krakow. Your data will be processed for the purpose of sending our newsletter. You have the right to request access to your personal data, their copies, rectification, deletion or limitation of processing, as well as the right to object to the processing and to lodge a complaint with the supervisory authority. More details can be found in our Privacy Policy.