Where Can I Obtain Information That My Data Is Being Transferred Outside Europe Based on SCCs?

ANSWER

Information about the transfer of your data outside the EEA should be provided by the data exporter.

Articles 13 and 14 of the GDPR require data exporters to inform the data subject about any intention to transfer personal data outside the EEA. Where SCCs are used as the transfer mechanism, the data subject must also be informed of this fact and provided with information on how to obtain a copy of those clauses.

Where SCCs are used, the data importer established outside the EEA may also be required to provide certain information to data subjects. This may include:

• its contact details;
• the categories of personal data it processes; and
• the recipients to whom the data may be disclosed.

(See Module 1, Clause 8.2(a) of the SCCs.)

This obligation arises where the data importer uses the received data for its own purposes (i.e., purposes other than those for which the data was originally processed by the data exporter).