Within a few days, answers were given, albeit not definitive, to the stringent expectations that followed the decision of the CJEU on the Schrems II case.
The decision of the Court, as is known, invalidated the Privacy Shield agreement and considered the standard or “SCC” contractual clauses to be inadequate to protect the rights of the data subjects in the event of indiscriminate access by law enforcement authorities or security services of the recipient country, outside the EU / EEA.
European Data Protection Board
In chronological order, first, the two releases by the EDPB occurred:
- Recommendation 01/2020 on “additional measures” for international data transfers
- Recommendation 02/2020 on European essential guarantees for surveillance measures.
Both recommendations were issued on 10 November 2020; the first is subject to public consultation until 21 December (deadline postponed) and will be applicable immediately after its publication. Moreover, experience indicates that any changes made following the consultation are generally marginal and do not affect the conceptual structure of the document. Consequently, it can be expected that this will be the setting of the new SCCs also in the final version.
New SCCs
On 12 November 2020, the EU Commission published the proposed new “SCC” Standard Contractual Clauses for international flows of personal data that consider the decision of the CJEU on the Schrems II case. The documentation is subject to public consultation until 10 December 2020 and is composed of:
- The draft Commission Implementing Decision on the standard contractual clauses which also indicates the methods of use of the clauses
- The draft Annex to the Implementing Decision of the Commission containing the new SCCs.
