What’s happening with SCCs? – Part 1

05/05/21 – If your organisation does not transfer personal data to ‘third countries’, i.e. countries outside the EEA that do not have a UK adequacy finding, then breathe a sigh of relief and feel free to go and do something else.  If, however, your organisation does transfer personal data to a ‘third country’ (which for these purposes includes the U.S.), then this is likely to be relevant to your data processing arrangements.

During an IAPP/LinkedIn Live event last week, the European Commission’s Head of International Data Flows and Protection, Bruno Gencarelli, explained that the delay to the adoption of the EU’s new Standard Contractual Clauses (New EU SCCs) is principally due to the volume of feedback that the European Commission has received since the publication of the draft New EU SCCs last November.  However, according to Mr Gencarelli, it is now ‘a question of weeks‘ until the New EU SCCs are adopted by the Commission.

Most privacy lawyers – including me – have been assuming that once the New EU SCCs are adopted by the Commission, then the UK’s ICO will adopt pretty much identical standard contractual clauses for UK data exporters.  This assumption has been based in part on the ‘copy & paste’ approach that the UK has so far taken to incorporating the EU GDPR (and for that matter the existing EU SCCs) into UK law, and in part on the fact that the UK is currently looking to secure a ‘clean’ EU adequacy decision while fully aware of the importance that the EU attaches to maintaining ongoing alignment of the EU and UK data protection frameworks.

It therefore came as a bit of a surprise when the ICO’s Deputy Information Commissioner, Steve Wood, announced today that the ICO ‘is working on bespoke UK standard clauses for international transfers, and intend to go to consultation on them in the summer‘.  No details yet, but the message is clear – if you’re expecting the UK’s new SCCs to be a ‘copy & paste’ of the EU’s New SCCs, then don’t.  And in terms of timing, it looks like UK data exporters may have to wait for another few months before they have access to updated SCCs for their transfers.

Part 2 to follow as soon as we have some more detail.