Standard Contractual Clauses

In our previous bulletin (2022-04), we have examined the concept of international data transfer and the European Data Protection Board (EDPB) Guidelines in terms of “territorial scope”. Accordingly, we have mentioned that the importers should be prepared to cooperate in the development of a transfer instrument: the new set of Standard Contractual Clauses -SCC's).

In this issue, the scopes of the SCCs are summarized to provide integrity of the issue and as a follow to the previous bulletin (no.4).

According to the General Data Protection Regulation (GDPR), contractual clauses ensuring appropriate data protection safeguards can be used as a ground for data transfers from the EU to third countries.

SCCs stand for “standard contractual clauses” for data transfers between EU and non-EU countries. On 4 June 2021, the Commission issued modernized standard contractual clauses under the GDPR for data transfers from controllers or processors in the EU/EEA (or otherwise subject to the GDPR) to controllers or processors established outside the EU/EEA.

The old SCCs have been repealed with effect from September 27, 2021. Since 27 September 2021, it is no longer possible to conclude contracts incorporating these earlier sets of SCCs. Until 27 December 2022, controllers and processors can continue to rely on those earlier SCCs for contracts that were concluded before 27 September 2021, provided that the processing operations that are the subject matter of the contract remain unchanged. This means;

- If, after September 27, 2021, the parties make any changes to an agreement incorporating the repealed versions of the SCCs affecting the processing operations that are to be carried out, the parties will be required to update the agreement to replace the repealed versions of the SCCs with the new versions.

- Where no such changes are made to existing agreements incorporating the repealed versions of the SCCs, those agreements will need to be updated to include the new version of the SCCs by December 27, 2022 at the latest.

In other words, in terms of "processing activities", contracts concluded on the basis of repealed versions of SCCs shall be deemed to provide appropriate safeguards for an additional period of 15 months (until 27 December 2022).

The new SCCs cover the data transfer from a “controller to controller”, “controller to processor”, “processor to processor”, “processor to controller”. The previous SCCs handled data transfer from controller to controller and controller to processor.

Within the new SCCs;

- It has been ensured that the persons concerned can claim certain provisions of the SCC and their contractual rights against the SCC parties as beneficiaries.

- Brought additional obligations regarding access requests by public institutions.

- In the course of time, it has become possible to add new parties to SCCs other than signatories.

The content herein is aimed at providing a general insight regarding the subject. For customized circumstances or for further information, please refer to your lawyer.