On 27 September 2021, the EU decisions that gave effect to the old standard contractual clauses (SCCs) for international transfers of personal data were repealed. This means that organisations looking to implement SCCs to safeguard any new transfers of personal data out of the European Union will now have to use the new modular SCCs released in June 2021 (for further details please see "New rules on protection of transfers of personal data outside European Union").
Contracts concluded before 27 September 2021 that incorporated the old SCCs to safeguard transfers out of the European Union will need to be replaced before 27 December 2022.
The following bullet points illustrate the developments in this area so far and which clauses may be used and when:(1)
- 4 June 2021 – new EU SCCs published;
- 28 June 2021 – UK adequacy agreements adopted (for further details, please see "European Commission decides that United Kingdom provides "adequate level of protection"");
- 27 September 2021 – old EU SCCs repealed; new EU SCCs must be used for new data transfers out of the European Union; and
- 27 December 2022 – new EU SCCs must be used for all data transfers out of the European Union (including existing transfers which relied on the old EU SCCs).
For further information on this topic please contact Paula Barrett at Eversheds Sutherland's London office by telephone (+44 20 7919 4500) or email ([email protected]). Alternatively, contact Emmanuel Ronco at Eversheds Sutherland's Paris office by telephone (+33 1 55 73 40 00) or email ([email protected]), Nils Müller at Eversheds Sutherland's Munich office by telephone (+49 89 54565 0) or email ([email protected]), or Olaf van Haperen at Eversheds Sutherland's Amsterdam office by telephone (+31 20 5600 600) or email ([email protected]). The Eversheds Sutherland website can be accessed at www.eversheds-sutherland.com.
Endnotes
(1) To see this timeline in graphic form, click here.