Data is everywhere and it is more valuable than oil. In the Digital Age companies depend on building up customer profiles so they can better understand and sell to those customers. It is estimated that our data will be worth $197.7 billion by 2022 – more than the total value of American agricultural output.[1]
But there are strict rules in place around when, where and how you are allowed to transfer that data out of the UK or the EU. In this article, “GDPR” refers to both the UK and EU GDPR.
What is the new UK adequacy decision all about?
In June 2020, the EU Commission agreed that the UK will be on the EU’s safe list of countries for, at least, the next 4 years. This means that data can be sent unrestricted from the EU (or EEA) to the UK.
What are these Standard Contractual Clauses (‘SCCs’) I keep hearing about?
Standard Contractual Clauses or ‘SCCs’ are basically a set of clauses that you ask the receiving company to sign. In signing them, the receiving company agrees to provide an adequate level of data protection for the data they receive.
What are the new SCCs and how are they different from the old ones?
New SCCs were approved by the European Commission (EC) in June 2021. They were updated to comply with GDPR and the Schrems II decision. To rely on the SCCs you must use the precise wording laid down by the EC.
The new SCCs contain clauses for:
a) Controller to Controller transfers
b) Controller to Processor transfers
c) Processor to Processor transfers
d) Processor to Controller transfers
This means you can choose based on the type of transfer you are making ie based on whether the data exporter and importers are ‘controllers’ or ‘processors’ under GDPR in respect of the personal data processing. c) and d) are new and these types of clauses didn’t exist under the old SCCs.
The new SCCs also allow for multiple data exporters to be involved in the contract and for new parties to the contract to be added at a later stage.
What is this Schrems II case all about?…
Read More