On Friday, 4 June, the European Commission took a further step
to reinforce legal certainty under the GDPR by adopting two new
sets of Standard Contractual Clauses (SCCs),
intended to allow safe and free cross-border data transfers.
The SCCs come in the form of implementing decisions under the
GDPR1 and provide tools for:
- data transfers between controllers and
processors2, and
- transfers of personal data to third
countries3.
While both provide a useful tool for businesses to ensure
compliance with data protection safeguards, adoption of the latter
was highly anticipated in the aftermath of the Schrems
II judgement of the Court of Justice of the European
Union (CJEU). This judgement declared the EU
Commission's decision on the adequacy of data protection
provided by the EU-US Privacy
Shield invalid4. Although this confirmed
the validity in principle of the previous set of SCCs5,
upgrades have become necessary to ensure a level of protection
equivalent
