Transferring Personal Data Outside of the EEA

|
|
PUBLISHED on
22 Jul
2022

This blog looks at a very specific area of the GDPR - Article 28 and data transfer outside of the EEA.  One of the ways in which you can legitimise an ex-EEA data transfer is by using the standard contractual clauses (SCCs).

Article 28 mandates a number of requirements that must be placed on data processors, by data controllers, via a contract.  The question is, are the SCCs sufficient to meet these requirements?  Whilst the SCCs are pretty comprehensive, they were drafted before the GDPR came into effect and, as a result, not all of the requirements of Article 28 are addressed by the SCCs.

So, what can you do?

The challenge with the SCCs is that they must be used verbatim.  Any change to the wording, even if it has no material effect on the interpretation, means that the parties cannot claim to be using the SCCs.  However, it is permissible to add clauses or incorporate the SCCs in a broader contract, ’provided nothing in the other contract or additional clauses alters the effect of any of the model clauses’.

So, if you are outsourcing data processing to processors outside the EEA and transferring PII, then you should supplement, and not solely rely on, the SCCs.  The specific gaps between Article 28 and the SCCs are, broadly speaking, that the SCCs (and Appendix where applicable) do not:

  • Address the duration of processing
  • Contain a requirement for the data importer to commit to confidentiality
  • Contain a requirement to support the response to a data subject request
  • Comply with the timing or cooperation requirements relating to a data breach
  • Address the processor participating in a data protection impact assessment (DPIA)
  • Address all audit requirements Address onward transfer of data outside of the EEA.

Do you need assistance in improving your GDPR compliance position?

URM can offer a host of consultancy services to improve your DP policies, privacy notices, DPIAs, ROPAs, privacy notices, data retention schedules and training programmes etc.
Thumbnail of the Blog Illustration
Data Protection
Published on
6/2/2023
Analysis of Fines Imposed by the Information Commissioner’s Office in 2022

When looking to comply with the General Data Protection Regulation (GDPR), it is always a worthwhile exercise....

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
25/7/2022
The CJEU Declares the EU-US Privacy Shield Invalid and SCCs Valid

On 16 July 2020, the CJEU issued its judgement on the adequacy of both the Privacy Shield and standard contract clauses (SCCs).

Read more
Thumbnail of the Blog Illustration
Data Protection
Published on
29/5/2024
First official European response to the Data Protection and Digital Information Bill

URM’s blog explores the first formal European response to the DPDI Bill, and how the Bill may jeopardise the UK’s adequacy status when it reforms the UK GDPR.

Read more
We used URM as we had a large amount of information to redact for a Court of Protection case and neither had the time nor the knowledge to be able to complete this appropriately. URM were suggested to us and we made contact. They responded very quickly and were able to explain their role, estimated timescales & costings. During the initial consultation, they were very professional and approachable, and certainly had the skills we required. URM’s consultant provided us with details of the work they had completed before & we felt confident to pursue the work with them. We were on a tight deadline for court and URM were confident that they could provide the services we required in a timely manner. The logistics of sending a large amount of confidential documents were easy to navigate and straightforward. We were unable to very accurately gauge how much work was required, however URM’s Team supported us with this and maintained regular contact regarding their progress and addressed any concerns they had. When we needed to contact them, they were prompt with their responses. The work did take longer that envisaged, however that was due to the amount of work that we, as clients, were unable to accurately identify would be required. We did, however, meet the deadline for court. I would certainly use the services of URM again & if possible would work with same team. The services are not cheap, however redacting sensitive information is a skilled task and, therefore, having a professional complete this work is priceless.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.