Update: EU Standard Contractual Clauses

On Friday 4th June 2021, the European Commission published finalized versions of new Standard Contractual Clauses (SCCs).

What are Standard Contractual Clauses?

Standard Contract Clauses have been around for a long time and are used by companies worldwide to help them transfer personal data from the UK and Europe to other countries in compliance with the principles of European data protection law. Since the introduction of the GDPR (as well as high-profile cases like Schrems II), this mechanism has been under the spotlight as being outdated.

What has happened?

The SCCs have been discussed and much anticipated (by privacy practitioners at least) for some time. At a very high level, the new SCCs have been updated to:

• bring the wording of the SCCs in line with the GDPR;
• address the requirements made in the Schrems II decision; and
• broaden the scope of the situations where these data transfers may take place.

The decision comes into effect on 24 June 2021 and companies can use the previous SCCs for a further three months. After that, companies will have a further 15 months to get the new SCCs to replace the existing SCCs.

Your data and dotdigital

We understand that our clients (particularly their Data Protection Officers and privacy teams) will be keen to understand the impact this will have on your relationship with dotdigital. dotdigital has entered into contracts with the organizations listed on our Trust Center to ensure the safeguarding of personal data, including entering into Data Processing Agreements reflecting the obligations under the EU and UK GDPR and entering into the old SCCs (where relevant) to ensure that all customer data is protected. As a result of the recent update, we will be looking to update these safeguards with the new SCCs. Depending on your location, we may well have entered into the old SCCs with you directly. Similarly, we will be looking to update any existing SCCs with the new SCCs soon. Please note that dotdigital will be analyzing the content of the new SCCs over the coming days and will communicate specific updates and reach out to affected clients directly in due course. No immediate action is required by you.