Legal News

Do you transfer personal data outside Europe? There’s a 95% chance that you do.

A transfer of personal data to countries or organisations outside the European Economic Area ("EEA") may only take place subject to appropriate safeguards.

What guarantees? An "approved" contract, for example.

The General Data Protection Regulation (better known as the GDPR) provides an exhaustive list of those safeguards, and one of these is the use of European Commission approved model for contractual clauses or "Standard Contractual Clauses (or SCCs for GDPR nerds)."

What do you need to do? Install an update ... of your contract

As of June 4, 2021, there are new standard contract provisions. So we can get to work for you and replace the old provisions where necessary (as they pre-date the GDPR, after all).

Wait a minute ... just signing will be enough?

Of course not. You will also have to comply with the contract and enforce it during the whole time you are transferring personal data.

Timing? How much time do you have?

Do us a favour and read along - after all, the law can be so wonderfully clear, concise and comprehensive.

Spoiler alert: You have 3 months, and 15 months more in certain cases (and please read further below the quote)

"Decision 2001/497/EC and Decision 2010/87/EU should be repealed three months after the entry into force of this Decision. During that period, data exporters and data importers should, for the purpose of Article 46(1) of Regulation (EU) 2016)679, still be able to use the standard contractual clauses set out in Decisions 2001/497/EC and 2010/87/EU. For an additional period of 15 months, data exporters and data importers should, for the purpose of Article 46(1) of Regulation (EU) 2016)679, be able to continue to rely on standard contractual clauses set out in Decisions 2001/497/EC and 2010/87/EU for the performance of contracts concluded between them before the date of repeal of those decisions, provided that the processing operations that are the subject matter of the contract remain unchanged and that reliance on the clauses ensures that the transfer of personal data is subject to appropriate safeguards within the meaning of Article 46(1) of Regulation (EU) 2016/679. In the event of relevant changes to the contract, the data exporter should be required to rely on a new ground for data transfers under the contract, in particular by replacing the existing standard contractual clauses with the standard contractual clauses set out in the Annex to this Decision. The same should apply to any sub-contracting to a (sub-)processor of processing operations covered by the contract."

Easy to read, right?

Now what? Change over.

Many companies have been waiting impatiently for these new "Standard Contractual Clauses".

Working together with you, DEFENSIS Law Firm will check when you (or your supplier) needs to conclude such an agreement, how this can be done in the most practical way and - not unimportantly - how you can follow this up efficiently (and, above all, cost-consciously).

In the end, almost every company has data outside the EEA (European Economic Area) and no company wants to run unnecessary risks. But how can you approach this in a pragmatic way ?

With decades of experience in corporate IT law, DEFENSIS also advised many companies on the "protection of data" long before the GDPR came into force, and often as an integral part of the company's overall "contract management".

Please contact us for a no-obligation (= free) consultation at gdpr@defensis.be.

Together, we’ll look at what you need to tackle, and how much time you have to do so.