2021 has been a busy year for changes to the GDPR regime around international personal data transfers, particularly those between the EU and the UK. The trade deal agreed at the end of 2020 included period of grace to end of April 2021 for the EU to make an adequacy decision regarding the UK’s data protection regime. The period of grace was extended from the end of April to the end of June 2021 and as the deadline approached, we all wondered what could be causing the delay.  Finally the decision was made (unanimous by all Member States) on 28 June and widely reported.  However the decision is time limited to four years when it will be reviewed, so put 2025 in the diary as it is clear that this issue will continue to run.

Schrems II fallout

Following the Schrems decision a year ago in which the European Court ruled that even where Standard Contractual Clauses or Binding Corporate Rules are in place, controllers should introduce additional mechanisms when transferring personal data to third countries.  The European Data Protection Board published draft guidance around the additional measures required in December 2020 and it has now finalised its guidance (available here: https://edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en ).  So it is time to review international data transfers on the basis of either standard contractual clauses or binding corporate rules.

New Standard Contractual Clauses for International Data Transfers

The EU has also approved its new Standard Contractual Clauses (“SCCs”) for data transfers which apply to transfers of personal data out of the EU. The new clauses should be used for new contracts after 27 September 2021 and should replace the old SCCs in existing contracts by 27 December 2022.  Another one for the diary: to update existing contracts involving international transfers out of the EU in a quiet time next year. The text of the new SCCs can be accessed here.

The ICO in the UK has announced that it too is reviewing the UK’s position regarding Standard Contractual Clauses for use under the UK GDPR.

We provide an ongoing data protection compliance support service

Obviously these recent changes in the area of international transfers have kept us all hopping for months, but our clients know that we have their backs when circumstances change.  We keep an eye out for updates, we recommend the best course of action and support whatever decisions clients make.  Take a look at the key features of our support service here: https://dataprotection.me.uk/

Mandy Webster, Data Protection Consultant