Search
Contact
27.07.2022 | KPMG Law Insights, KPMG Law Insights

The countdown is on: Only 5 months left for Schrems II implementation deadline

The use of the new standard contractual clauses for data transfers to third countries has already been mandatory for new contracts since September 27, 2021. The corresponding implementing decision of the EU Commission ((EU) 2021/914 COM) gives those responsible until December 27, 2022 to adapt existing contractual relationships to the new models. Thereafter, all standard contractual clauses already concluded must also comply with the new requirements. As of today, those responsible have only five months left for the final implementation. However, this is not done with a mere exchange of forms.

Complex implementation

The conclusion of the new standard contractual clauses is not a mere formality, as both data transmitters and data recipients have additional obligations to fulfill. Particularly noteworthy is the obligation of the data transmitter to conduct a so-called “Transfer Impact Assessment” (abbreviated to “TIA”); i.e. an extensive risk assessment of the third country transfer in the individual case. In this context, the individual particularities of the law in the target country must be taken into account. Depending on the outcome, specific contractual, organizational or technical compensatory measures to protect personal data must be identified, agreed and implemented. As this can lead to considerable additional expenses for the data recipient, it is not self-evident that the relationship will continue under the current conditions.

Focus of the authorities

The legally compliant implementation of standard contractual clauses and the adoption of effective compensatory measures are currently the focus of regulatory activities. For example, the data protection supervisory authorities of France, Austria and Italy have now indicated that the compensatory measures provided by a search engine provider when using its analytics tool are not sufficient to ensure an adequate level of data protection. The responsible parties concerned were prohibited from using the analysis tool. The problems identified are likely to exist in a similar form at other U.S. providers. In addition, the data protection authorities of the states of Berlin, Lower Saxony, Rhineland-Palatinate, Saxony, Saxony-Anhalt and Bavaria are currently conducting a coordinated review of web hosters’ order processing contracts. The questionnaire used for this purpose also contains a section on third-country transfers and asks which version of the standard contractual clauses is used for this purpose.

Liability risks

The use of previous templates is no longer permitted after the transposition deadline and would constitute a breach of Art. 44 and 46 of the General Data Protection Regulation. In particular, this may result in the prohibition of the relevant data processing as well as fines of up to 4% of the annual turnover or 20,000,000 euros. In each case, the higher amount is decisive. In addition, there is a risk of claims for damages from those affected and, if necessary, warnings from competitors. It should not be neglected that the implementation of the new requirements – due to the transparency obligations under data protection law – can be ascertained by third parties without much effort, which increases the risk for data controllers of becoming the target of such measures.

Conclusion

Responsible parties who have not yet started updating standard contractual clauses in use should do so now at the latest. Often there is a multitude of such contracts and each one of them – in addition to the creation of a TIA – has to be individually redrafted and negotiated. The adaptation process is multi-step and should not be underestimated in terms of its complexity. Delayed implementation is easy to spot and poses a high liability risk that can be avoided by acting early.

Explore #more

17.04.2025 | KPMG Law Insights

What the coalition agreement means for the financial sector

The coalition agreement between the CDU/CSU and SPD also has an impact on the financial sector. Here is an overview. Increasing the energy supply The…

17.04.2025 | KPMG Law Insights

AWG amendment provides for tougher penalties for sanction violations

Due to the ongoing Russian war of aggression against Ukraine, the EU wants to make it easier to prosecute violations of EU sanctions. The corresponding…

16.04.2025 | KPMG Law Insights

What the new digitization plans in the coalition agreement mean

The coalition agreement shows how the future government wants to shape Germany’s digital future. What do the plans mean for companies in concrete terms? Here…

14.04.2025 | KPMG Law Insights

How the new coalition wants to accelerate investment in infrastructure

The coalition agreement between the CDU/CSU and SPD marks a fundamental new beginning in German infrastructure policy. In view of a considerable investment backlog, the…

14.04.2025 | KPMG Law Insights

Coalition agreement 2025 and NKWS: Booster for environmental and planning law?

In the current coalition agreement, environmental and planning law is mentioned at various points throughout the coalition agreement, highlighting its great importance. However, the…

11.04.2025 | KPMG Law Insights

What’s next for foreign trade? The plans in the 2025 coalition agreement

Foreign trade and foreign trade have become particularly explosive in view of the new US tariffs. The CDU/CSU and SPD have agreed on the following…

11.04.2025 | KPMG Law Insights

Coalition agreement 2025: What the plans mean for the economy

The CDU/CSU and SPD have agreed on a coalition agreement. The central theme is the renewal of the promise of the social market economy. The…

10.04.2025 | KPMG Law Insights

Coalition agreement 2025: Housing construction on the move

In the coalition agreement, the CDU/CSU and SPD have agreed comprehensive reform plans in the area of housing construction. The aim is to speed…

10.04.2025 | KPMG Law Insights

Energy in the 2025 coalition agreement: what the future government is planning

In the coalition agreement, the CDU/CSU and SPD commit to the German and European climate targets and Germany’s climate neutrality by 2045. To this…

10.04.2025 | KPMG Law Insights

Focus on labor law – this is what the 2025 coalition agreement provides for

The CDU/CSU and SPD agreed on a coalition agreement on April 9, 2025. The overarching title of the paper is “Responsibility for Germany”. On 146…

Contact

Francois Heynike, LL.M. (Stellenbosch)

Partner
Head of Technology Law

THE SQUAIRE Am Flughafen
60549 Frankfurt am Main

Tel.: +49-69-951195770
fheynike@kpmg-law.com

Miriam Oussalah

Manager

Münzgasse 2
04107 Leipzig

Tel.: +49 341 22572-500
moussalah@kpmg-law.com

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit https://home.kpmg/governance.

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.

Scroll