Is it necessary to comply with Section III of the SCCs when using Module 4?

ANSWER

Section III of the SCCs contains a specific exception where Module 4 is used by a processor operating within the EEA that returns data to a controller located outside the EEA, i.e., data that it originally received from that controller. In this situation, the personal data was originally processed outside the EEA and was therefore already subject to the laws of the third country. As a result, there is no need for the parties to conduct a Transfer Impact Assessment (Clause 14) or comply with the obligations concerning access to data by public authorities (Clause 15).

Example:

A Moroccan company uses cloud services provided by a Luxembourg-based company to store a database containing its customer data. SCCs (Module 4) may be used to transfer the data from Luxembourg (by the data exporter) back to Morocco. Since the data exporter is merely returning data that it previously received from Morocco, it is not required to comply with the provisions of Section III.

A contrario, this exception does not apply (meaning the parties must comply with Section III) if the data processed by the processor (the data exporter) and subsequently transferred outside the EEA to the controller (the data importer) includes personal data originating from Europe.

Example:

A Chilean company engages a Spanish processor to conduct market research and prepare marketing materials using customer data received from the Chilean company, as well as customer data collected by the Spanish company in Spain. Module 4 SCCs may be used by the Spanish processor to transfer aggregated data concerning both datasets to Chile. Since the data exporter is transferring not only data received from Chile but also data collected in Europe, it is required to comply with the requirements of Section III. This applies to the entire dataset transferred to Chile (i.e., both the data received from Chile and the data collected in Spain).