The next few weeks will likely be very busy for companies on the GDPR international data transfer front as there have been a number of key European developments over the last few days including:
- New Standard Contractual Clauses: The European Commission’s Article 93 Committee (made up of representatives from EU Member States) approved the new Standard Contractual Clauses (SCCs) on May 19, 2021 and it is understood that the new SCCs may be published in June. The new SCCs have been prepared by the Commission to take into account the EU’s Court of Justice decision in Schrems II (CJEU) decision and subsequent guidance on Schrems II. Once published, companies will be granted a grace period in which to transition from the current to the new SCCs. Putting in place the new SCCs will be a considerable task for many international companies in particular, given the relatively more onerous provisions in the new SCCs as compared to the existing SCCs.
- European Parliament Resolutions on Schrems II and UK Adequacy Decision: The European Parliament on May 21, 2021 passed two resolutions relating to international data transfers and the CJEU ruling in Schrems II, and the Commission’s UK adequacy decision, respectively. In the resolution on the Schrems II ruling, the Parliament amongst other issues: (i) expressed its concern about the lack of enforcement on international data transfers and urges authorities to focus on enforcement of international transfer requirements and monitor the use of SCCs by companies; (ii) urges the European Data Protection Board (EDPB) to urgently publish further guidance on international transfers and Schrems II; (iii) asserts that any future adequacy decision by the Commission should not rely on a system of self-certification as was the case with the EU-US Privacy Shield; and (iv) calls on the Commission not to adopt an adequacy decision in relation to the US unless “meaningful reforms” are introduced. In the resolution on the UK adequacy decisions, the European Parliament asked the Commission to modify its draft decisions to bring them into line with clarifications required by the EDPB on UK’s bulk access practices, onward transfers and international agreements. The resolution provides that if the UK adequacy decisions are adopted without changes, Data Protection Authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible. Although the resolutions are not legally binding on the Commission, they will no doubt need to be considered carefully.
- EDPB’s Schrems II Supplementary Measures Guidance: We have eagerly been awaiting for several months the final Schrems II Guidance to be adopted by the EDPB at its monthly plenary meetings. Eyes now turn to the next EDPB plenary meeting on June 15, 2021 for finalization. Once the final Schrems II Guidance is published, companies will be able to take steps to resolve their approach to their Schrems II international data transfer projects.