The new Standard Contractual Clauses provide European data exporters with clear requirements regarding international data transfers, but the new legal certainty comes with the price of additional assessment and documentation requirements. Will the upcoming Trans-Atlantic Data Privacy Framework be the easier solution for US data transfers?

More than two years after the Schrems II decision, where the European Court of Justice declared the EU-US Privacy Shield invalid (Case C-311/18), European data controllers and processors finally have quite stable legal guidelines with regard to international data transfers—both in general and for the United States in particular. As most such data handlers have US-based business partners or service providers—and such business relations often require the exchange of personal data—the legal privacy developments over the past two years were more than welcome. Although many US data recipients, in particular bigger service providers operating under EU US Privacy Shield certification, promptly switched to the then-applicable Standard Contractual Clauses (SCCs), the legal uncertainty remained due to the ECJ’s vaguely formulated requirements for additional protective measures.

These requirements were clarified when the European Commission issued new SCCs in June 2021, which must replace the old SCCs from 27 December 2022.

Below, we briefly outline the structure of the new SCCs and the new requirement for a “data transfer impact assessment” as well as provide an outlook for the new Trans-Atlantic Data Privacy Framework between the EU and US, which is to replace the Privacy Shield.

New SCCs—structure and application

As noted above, on 4 June 2021 the Commission published the new Standard Contractual Clauses for transferring personal data between the European Union and third (i.e. non-EU) countries.

The structure of the new SCCs follows a modular approach, with four transfer scenarios:

• Controller-to-Controller (Module One)
• Controller-to-Processor (Module Two)
• Processor-to-Processor (Module Three)
• Processor-to-Controller (Module Four)

In line with Art. 3 (2) of the General Data Protection Regulation (EU) 2016/679 (GDPR), the new SCCs expressly stipulate that a data exporter can be established outside the EU. This means that a non-EU based controller or processor can enter into the new SCCs with their processor or sub-processor. Further, multiple parties can now conclude the new SCCs, which include a “docking clause mechanism” that allows new parties to be added at a later stage. Also, if the parties conclude Modules Two or Three of the new SCCs, there is no need for a separate data processing agreement under Art. 28 GDPR, as these clauses already contain all provisions required under Art. 28 GDPR.

Clause 14 of the new SCCs is new and will likely result in additional paperwork. When personal data is transferred to a third country, the parties are obliged to assess the laws and practices of that country that are applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorizing access by public authorities and preventing the data importer from fulfilling its obligations under the new SCCs. This assessment is the data transfer impact assessment (DTIA), which should not be confused with the data protection impact assessment (DPIA) under Art. 35 GDPR. In particular, the DTIA requires the parties to assess the following:

• The specific circumstances of the transfer including

• the length of the processing chain,
• the number of actors involved and the transmission channels used,
• the intended onward transfers,
• the type of recipient,
• the purpose of processing,
• the categories and format of the transferred personal data,
• the economic sector in which the transfer occurs,
• the storage location of the data transferred;

• The laws and practices of the third-country destination (including those requiring the disclosure of data to public authorities or authorizing access by such authorities) relevant in light of the specific circumstances of the transfer, and the applicable limitations and safeguards;
• Any relevant contractual, technical or organizational safeguards put in place to supplement the safeguards under these clauses (including measures applied during transmission and for the processing of the personal data in the country of destination).

In summary, European data exporters (including those not based in the EU but that are subject to the GDPR under to Art. 3 (2)) will have to analyze the roles of the parties (including possible onward transfers) and to determine the relevant Module(s), including any possibly required safeguards and further assessments.

In practice, the DTIA will most likely be the biggest challenge of the new SCCs, as the parties will not only have to assess the risks with regard to the first data recipient (and the actual contracting partner), but also with regard to onward data processors, who may not be so willing to answer comprehensive questionnaires regarding their processing processes, technical and organizational measures, etc.

The European Data Protection Board (EDPB) already attempted to flesh out the obligation specified in Clause 14 of the new SCCs in their extensive Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, dated 18 June 2021. Whether or not one finds these recommendations useful, data exporters are still largely on their own when analyzing US law.

At the beginning of 2022, the German Data Protection Conference published a comprehensive expert opinion (in German and English) by University of Texas professor and American legal expert Steven Vladeck, who also served as an expert witness in the Schrems II proceedings before the Irish court. This opinion may be helpful for European data exporters when analyzing the legal situation in the US in general. That said, the specific assessment with regard to the actual risks and challenges of the particular data transfer at hand must still be undertaken by the parties themselves.

New EU US Privacy Shield in sight?

On 25 March 2022, the United States and the European Union announced that they agreed in principle on a new Trans-Atlantic Data Privacy Framework (TADP Framework), in order to replace the Privacy Shield. The new framework addresses in particular the ECJ’s concerns about the escalating powers of US surveillance agencies and makes a commitment on the US side to implement reforms that will strengthen privacy and civil liberties protections applicable to US intelligence activities. On 7 October, US President Joe Biden signed an executive order limiting the ability of US national security agencies to access people’s personal information, as part of the TADP Framework.

In particular the TADP Framework foresees the following key principles:

• A legal basis for international data transfers between the EU and participating US companies;
• A new set of rules and binding safeguards to limit access to data by US intelligence authorities to what is necessary and proportionate to protect national security; US intelligence agencies will adopt procedures to ensure effective oversight of new privacy and civil liberties standards;
• A new two-tier redress system to investigate and resolve complaints of Europeans regarding data access by US Intelligence authorities, which includes a Data Protection Review Court;
• Strong obligations for companies processing data transferred from the EU, which will continue to include the requirement to self-certify through the US Department of Commerce their adherence to the principles;
• Specific monitoring and review mechanisms.

Once the TADP Framework is applicable, European data exporters may find it to be the less complicated legal instrument for data transfers to the US, as the burden of documentation and compliance will mostly be shifted to the participating US data importers.