June 14, 2021
On June 4th the European Commission adopted revised standard contractual clauses for international transfers (the “new SCCs”).
Much ink has been and will be spilled on the legal and commercial significances of the new SCCs provisions.
Over the next weeks we will share our thoughts on selected topics under the new SCCs.
This post focuses on an important practical aspect that the new SCCs do not address.
Considering the legal environment in which the new SCCs were formulated, it is not surprising that an entire section of the new SCCs (Section III) is designed to address the Schrems II ruling requirements. We focus on in this post on the operational and financial aspects of Clause 15 which sets out notification and litigation obligations on data importers in relation to data access by public authority.
This set of obligations includes:
- Notifying the data exporter and, where applicable, the data subjects, of any disclosure request from a public authority, or any direct access by public authorities to personal data;
- Making efforts to obtain a waiver of the prohibition to provide the notification, if such notification is prohibited under the laws of the destination country;
- Reviewing the legality of the disclosure requests;
- Pursuing possibilities to appeal a disclosure request if the request considers to be unlawful and seek injunctive relief to suspend the execution of the request until a final court ruling.
Though these obligations may involve considerable costs and resources, the new SCCs do not indicate which party should bear such costs. Importers should pay close attention to these requirements. Without a financial arrangement with the exporters, they will need to bear the entire costs associated with these litigation and notification requirements.
Stay tuned for our post next week with further thoughts and insights on the new SCCs.
