Table of Contents
Introduction of New Standard Contractual Clauses
On June 4, 2021, the European Commission issued an implementing decision regarding standard contractual clauses for the transfer of personal data to third countries based on Regulation (EU) 2016/679 of the European Parliament and of the Council, under which new content for the standard contractual clauses was adopted.
The standard contractual clauses were updated in connection with the introduction of the GDPR and as a consequence of the ruling of the Court of Justice of the European Union (CJEU) of July 18, 2020, in the Schrems II case.
The previous content of the standard contractual clauses, which included entities transferring personal data outside the EEA, was based on the decision of the European Commission of February 5, 2010, issued under Directive 95/46/EC, and was in effect prior to the introduction of the GDPR.
Validity of the New Standard Contractual Clauses
The new standard contractual clauses came into effect on June 27, 2021. The old standard contractual clauses were repealed on September 27, 2021, after a three-month transitional period.
Agreements that were concluded before September 27, 2021, may continue to be valid in their unchanged form until December 27, 2022 (see announcement on the Polish DPA website).
Any new agreement concluded after September 27, 2021, requires consideration of the application of the new standard contractual clauses if, during its performance, there is a sharing or any other form of transfer of personal data outside the EEA.
Modular Structure of the New Standard Contractual Clauses
The content of the new SKU contained in the executive decision of the Commission is a document consisting of 31 pages (in Polish), which includes four alternative contract templates, referred to as modules. The appropriate module should be included for the specific relationship between the entities involved in the transfer of personal data outside the EEA:
- Module one: agreement between two data controllers, including one data controller outside the EEA;
- Module two: agreement between a data controller and a data processor outside the EEA;
- Module three: agreement between two data processors, including one data processor outside the EEA;
- Module four: agreement between a data processor and a data controller in a third country.
Some provisions of the SKU are general and identical for each module. The remaining sections are specific to individual modules, as illustrated by the following example:
Clause 18
Choice of forum and jurisdiction
Module one: transfers between data controllers
Module two: transfers by a data controller to a data processor
Module three: Transfers between data processors
a) Any disputes arising from the clauses shall be resolved by the courts of the EU member state.
b) The parties agree that these are the courts: .......... (please specify the member state).
c) The data subject may also initiate legal proceedings against the data transferring entity or the data receiving entity before the courts of the member state in which their habitual residence is located.
d) The parties agree that they will be subject to the jurisdiction of these courts.
Module four: Transfers by a data processor to a data controller
Any disputes arising from these clauses shall be resolved by the courts ......... (please specify the country).
The purpose of including the SKU is to secure the legal basis for the transfer of data to a third country. This means that the content of the individual modules should not be modified, except for the selection of the appropriate module and its completion in the sections indicated by the EU legislator.
Business practice - an additional 60 pages of the agreement with a business partner from the USA
The judgment of the Court of Justice of the European Union (CJEU) of June 16, 2020, in the case of Schrems II invalidated the Commission's executive decision 2016/1250 of July 12, 2016, regarding the adequacy of protection provided by the EU-U.S. Privacy Shield.
The Privacy Shield significantly facilitated the transfer, including the sharing of personal data with contractors in the USA. Following its invalidation, the new SKU may now serve as a commonly chosen basis for entrepreneurs for sharing and other forms of data transfer to the USA.
It should not be overlooked that entering into a new, additional agreement based on the SKU may prolong negotiations among business partners. An entity operating in the Polish market is usually interested in concluding an agreement in Polish, while a foreign entity prefers an agreement in English.
Concluding an agreement in two language versions, based on a template provided by EU institutions, entails the necessity of signing an additional document exceeding 60 pages.
Four templates developed by ODO 24
Templates for download
In response to market expectations, to simplify and expedite your negotiations with international business partners, the ODO 24 team has developed four templates of standard contractual clauses compliant with the GDPR, but "streamlined" of unnecessary content.
Each template contains only the content of the relevant module, in two language versions, i.e., Polish and English:
- Module One: ADO - ADO;
- Module Two: ADO - PP;
- Module Three: PP - PP;
- Module Four: PP - ADO;
Additional Obligations
Each of the above templates must be completed in the indicated fields to tailor the document to the specific data transfer between contractors.
It should be recalled that merely applying the new SKU may not be a sufficient basis for transferring data outside the EEA. In the Schrems II ruling, the Court of Justice noted that under certain circumstances, further measures are necessary, in addition to the SKU, to establish an adequate level of data protection in a third country. In particular, entities transferring data are not exempt from the obligation to independently assess the law and practices regarding personal data in the third country to which they intend to transfer data.
In case of doubts regarding the required scope of appropriate actions and the application of suitable security measures, it is advisable to consider consultations with experts in the field of personal data protection.
Marcin Kuźniak – our experienced advisor is at your disposal. Check the available dates and schedule a free consultation.
Check what you remember - a reward for the correct answer!
Which of the following statements is incorrect:
