On September 12, 2024, the European Commission announced that it will launch a public consultation on additional standard contractual clauses for international transfers of personal data to non-EU controllers and processors that are subject to the EU GDPR extra-territorially (“Additional SCCs”), something that has been promised by the European Commission as far back as 2022. The public consultation is planned for the last quarter of 2024.
The European Commission plans to adopt the Additional SCCs to fill an existing gap in the EU data privacy framework in relation to data transfers. In brief, the standard contractual clauses that the European Commission adopted in June 2021 only cover international transfers of personal data to non-EU controllers and processors that are not subject to the EU GDPR (“Current SCCs”) (see our blog post on the Current SCCs). They do not cover transfers to non-EU controllers and processors that are subject to the EU GDPR.
According to the European Data Protection Board (“EDPB”), transfers to non-EU controllers and processors subject to the GDPR extra-territorially are subject to the GDPR’s restrictions on international transfers (see our blog post on the EDPB’s guidelines, which were last updated in 2023). Currently, there are no SCCs for transferring personal data to such controllers and processors. The EDPB called on the European Commission to develop SCCs for such transfers, in particular, to address the possibility that the controllers or processors importing the data may be subject to conflicting national laws and access requests from public authorities, including local law enforcement. The European Commission has responded to the EDPB’s call.
* * *
Covington’s Data Privacy and Cybersecurity team regularly advises companies on their most challenging compliance issues in the EU and other key markets, including on international data transfers. Covington is monitoring how more and more countries are adopting standard transfer clauses for international data transfers. Examples include Brazil, Turkey, and Saudi Arabia. Our team is happy to assist companies with any other inquiries on this topic.
(This blog post was written with the contributions of Diane Valat.)