The use of the new standard contractual clauses for data transfers to third countries has already been mandatory for new contracts since September 27, 2021. The corresponding implementing decision of the EU Commission ((EU) 2021/914 COM) gives those responsible until December 27, 2022 to adapt existing contractual relationships to the new models. Thereafter, all standard contractual clauses already concluded must also comply with the new requirements. As of today, those responsible have only five months left for the final implementation. However, this is not done with a mere exchange of forms.
The conclusion of the new standard contractual clauses is not a mere formality, as both data transmitters and data recipients have additional obligations to fulfill. Particularly noteworthy is the obligation of the data transmitter to conduct a so-called “Transfer Impact Assessment” (abbreviated to “TIA”); i.e. an extensive risk assessment of the third country transfer in the individual case. In this context, the individual particularities of the law in the target country must be taken into account. Depending on the outcome, specific contractual, organizational or technical compensatory measures to protect personal data must be identified, agreed and implemented. As this can lead to considerable additional expenses for the data recipient, it is not self-evident that the relationship will continue under the current conditions.
Focus of the authorities
The legally compliant implementation of standard contractual clauses and the adoption of effective compensatory measures are currently the focus of regulatory activities. For example, the data protection supervisory authorities of France, Austria and Italy have now indicated that the compensatory measures provided by a search engine provider when using its analytics tool are not sufficient to ensure an adequate level of data protection. The responsible parties concerned were prohibited from using the analysis tool. The problems identified are likely to exist in a similar form at other U.S. providers. In addition, the data protection authorities of the states of Berlin, Lower Saxony, Rhineland-Palatinate, Saxony, Saxony-Anhalt and Bavaria are currently conducting a coordinated review of web hosters’ order processing contracts. The questionnaire used for this purpose also contains a section on third-country transfers and asks which version of the standard contractual clauses is used for this purpose.
The use of previous templates is no longer permitted after the transposition deadline and would constitute a breach of Art. 44 and 46 of the General Data Protection Regulation. In particular, this may result in the prohibition of the relevant data processing as well as fines of up to 4% of the annual turnover or 20,000,000 euros. In each case, the higher amount is decisive. In addition, there is a risk of claims for damages from those affected and, if necessary, warnings from competitors. It should not be neglected that the implementation of the new requirements – due to the transparency obligations under data protection law – can be ascertained by third parties without much effort, which increases the risk for data controllers of becoming the target of such measures.
Responsible parties who have not yet started updating standard contractual clauses in use should do so now at the latest. Often there is a multitude of such contracts and each one of them – in addition to the creation of a TIA – has to be individually redrafted and negotiated. The adaptation process is multi-step and should not be underestimated in terms of its complexity. Delayed implementation is easy to spot and poses a high liability risk that can be avoided by acting early.
© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit https://home.kpmg/governance.
KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.