On the 4th of June 2021 the European Commission has published a new set of Standard Contractual Clauses (“SCCs”) (see our article here) in order to update the “old” SCCs to adjust them to the provisions of the Schrems II decision of July 2020. Since the United Kingdom has left the European Union on the 1st of January 2021, they were no longer part of the European Union at the time of the publication of the “new” set of SCCs by the European Commission. This means that the “new” SCCs does not apply to the United Kingdom.
The Schrems II-decision, on the other hand, was issued before the 1st of January which is why the UK was still bound to the CJEU at that time and must implement the decision and its respective provisions.
Therefore, the UK has to develop their own SCCs in order to offer businesses an equivalent security guarantee for third country transfers of data acc. to art. 46 UK GDPR. These new transfer mechanisms have been laid before Parliament on the 2nd of February and will come into force on the 21st of March 2022, should the Parliament approve the new contracts.
If approved, the UK will offer two new options for ensuring an adequate level of data protection in the country that data should be transferred to: The International Data Transfer Agreement (IDTA) on the one hand and the International Data Transfer Addendum (the Addendum) on the other.
While the IDTA has a standalone agreement, the Addendum offers a complete set of clauses and information, Therefore, the addendum follows the approach to amend the European SCC in order to make them applicable for the United Kingdom.
The main reason for this differentiation is that the Addendum can be used for companies that also have implemented the European SCCs while the IDTA shall serve companies that only transfer data from the UK and do not already have the European SCCs in place. We are happy to consult you further on the differences and the advantages and disadvantages of each transfer mechanism in order for you to choose the mechanism that fits best to your company and processes.
Equally to the EU the UK has also implemented a transition period meaning that the new transfer mechanisms have to be implemented by the 21st of March 2024. “Old” SCCs that are conducted until the 21st of September 2022 will also remain valid until the 21st of March 2024 which ultimately means that as of the 21st of September either the IDTA or the Addendum has to be implemented if no adequacy decision has been granted for the third country in question or if no other security guarantee is applicable.
In addition, the “old” SCC even if valid until the 21st of March 2024 by conducting them before the 21st of September 2022 have to be replaced before the end of the transition period.
The ICO has announced that additional information will be published soon. These will include in particular:
- a clause by clause guidance to the IDTA and Addendum,
- a guidance on how to use the IDTA,
- a guidance on transfer risk assessments,
- and
- further clarifications on the international transfers guidance.
We will keep you updated.