The final countdown for switching to the new EU Standard Contractual Clauses (SCC) for data transfers between the EU and non-EU countries has begun. Starting on December 27, 2022, data controllers and processors around the world that process personal data of EU residents will no longer be able to rely on the old SCCs without violating the General Data Protection Regulation (GDPR). This means that companies have the legal obligation to replace all previously used SCCs with the new ones, and demonstrate having done so in case of audit.
As a reminder, SCCs are standardized and pre-approved model data protection clauses that allow data controllers and data processors to comply with their obligations under EU data protection law. They ensure that appropriate data protection safeguards are in place for international data transfers. SCCs must be properly filled and signed by the parties. Consequently, simply including a reference to the SCCs in a data processing agreement is not sufficient and does not comply with EU law.
One must keep in mind that violating the GDPR may result in heavy penalties for big and small organizations alike. The absence of SCCs may lead to a penalty going up to 10M euros (~ 10,500,000 USD) or up to 2 % of the total worldwide annual revenue of the preceding financial year, whichever is higher.
We practice both US and European law, and have particular expertise in the field of privacy and data protection law. If you wish to ensure that your organization complies with its obligations when transferring EU personal data to the United States, please do not hesitate to contact us, we would be delighted to assist you!