The EU Commission is expected to adopt the long awaited updated Standard Contractual Clauses (“SCCs”) on June 4, 2021. In the wake of the Schrems II decision invalidating the EU-U.S. Privacy Shield, the SCCs have played an increased role as an appropriate safeguard for transferring personal data from the European Economic Area to recipients in the U.S. and other countries without an EU Adequacy Decision. Globalization and the growth in outsourcing have created unanticipated transfer scenarios the original SCCs were unable to adequately address. For U.S. companies sending or receiving personal data from the European Economic Area, these new clauses will help accommodate an expanded set of transfer arrangements including processor to processor and processor to controller. Among other changes, it is anticipated the SCCs will address the data importer’s duties in situations where applicable laws affect its ability to comply with the SCCs, an issue raised in the Schrems II decision. Companies currently transferring personal data in reliance on existing SCCs will have a grace period in which to replace them with the new SCCs.
