The new EU Standard Contractual Clauses as a type of appropriate safeguard in the international transfer of personal data

Abstract

Personal data flow more freely across borders and represent one of the most significant forces behind the process of globalisation.1 Although this process is inevitable, it has to respect human rights, especially the right to data protection. One of the most commonly used transfer tools under the General Data Protection Regulation are standard contractual clauses. These tools are used in case of the transfer of personal data to third countries in the absence of adequacy decision. In June 2021 the European Commission adopted the new Standard Contractual Clauses. There is a multifaceted change concerning the new law’s scope, structure and substance compared with the previous versions. This change reflects the new requirements in light of the technological development and the Schrems II judgment. Above all, this was an opportunity to articulate all data protection requirements for international data transfers expressly. Especially, to capture lacking relations between data controllers and data processors by way of a modular approach. This paper summarises the functionality of the new standard contractual clauses in light of the content and rationale of the international transfer of personal data and provides an in-depth oversight of its scope and structure. The ultimate aim is to reach a compromise in order to both ascertain a sufficient level of data protection on the one hand, and not create unnecessary obstacles to cross-border data flows on the other. Hence, it also attempts to answer the question as to whether these standard contractual clauses will stand the test of time, especially bearing in mind some burdensome obligations.