Today the European Commission published its much anticipated
decision on the new standard contractual clauses
("SCCs") for the transfer of personal
data from the European Union to third countries, and the template
SCCs. The new SCCs are modular in nature, and cover all relevant
data transfer scenarios, including processor to processor, and
processor to controller transfers (which were not currently covered
by the previous SCCs).
The new SCCs address the CJEU's landmark decision in
Schrems II by incorporating a number of terms designed to
ensure an appropriate level of protection for personal data that is
transferred to third countries from the EEA. The new SCCs contain
significant measures relating to requests to access personal data
from public authorities in third countries. These measures include
a requirement that the data importer must (i) review the legality
of any request it receives from a public authority; and; (ii)
challenge the request (to the extent that
