June 4, 2021. The European Commission has published two implementing decisions – No. 2021/915 and No. 2021/914 – containing two sets of new contractual clauses. The case concerns the transfer of personal data to third countries outside the European Economic Area. Under the new rules, it is no longer possible to use the old standard contractual clauses after 27 September 2021. In addition, data transfers based on them have to be brought into line with the new legal status by December 27, 2021.
What is changing?
The first Commission Decision replaces the previously used Decisions 2001/497/EC and 2010/87/EU on cross-border data transfers to third countries. The purpose of the second set of clauses, on the other hand, is related to the needs of information flows between data controllers and processors.
Thus, the new standard clauses are divided into data transfers:
- between controllers;
- between a controller and a processor;
- from a processor to another processor;
- from a processor to a controller.
Importantly, the ability to interfere with the content of the new standard contractual clauses adopted by the European Commission is very limited. In particular, they may be supplemented with provisions on additional data processing safeguards and a clause on the applicable law.
The previous standard contractual clauses were based on the provisions adopted in implementation of Directive 95/46/EC of the European Parliament and of the EC Council of 1995. When RODO started to apply in May 2018, the clauses were not updated. Earlier Commission decisions did not specifically address data transfers between processors and from processors to controllers. Therefore, when such data flows occurred between the entities involved, this resulted in significant practical and legal difficulties.
Transitional periods
The Commission’s decisions came into force on 27 June 2021. In contrast, the previous contractual clauses were repealed with effect from 27 September 2021. This means that during the aforementioned transitional period, businesses had the option to enter into contracts under either the old or new standard contractual clauses.
For contracts governing transfers of personal data to third countries based on the old contractual clauses, a transitional period of 18 months was introduced, which applies until 27 December 2022. By that date, all existing data transfers outside the European Economic Area will have to be regulated under the new standard of contractual clauses.
Do you want to be up-to-date? Subscribe to our newsletter!