The European Commission has published a Draft Implementing Decision on Standard Contractual Clauses (SCCs) for the transfer of personal data to third countries comprising the relevant clauses to be used by controllers and processors.
This Draft follows both the Court of Justice of the European Union (CJEU) judgement “Schrems II”, which stated the principle that, where personal data is transferred to third countries, it has to be ensured that the level of protection of natural persons guaranteed by EU law is not undermined, and the European Data Protection Board’s (EDPB) recommendations on supplementary measures for SCCs.
The Draft SCCs provide four different modules:
1. Transfer Controller to Controller;
2. Transfer Controller to Processor;
3. Transfer Processor to Processor;
4. Transfer Processor to Controller.
A public consultation is ongoing: the deadline is 10 December 2020.