New Standard Contractual Clauses: 2022 deadline, what do you need to do?

Companies processing cross-border data transfers from the European Union (EU) / European Economic Area (EEA) to third countries must update existing contracts to reflect the new Standard Contractual Clauses (SCCs) issued by the European Commission on 4 June 2021. This stems from the decision issued by the Court of Justice of the European Union (CJEU) in July 2020 which impacts how companies transfer personal data outside the EU/EEA.

This decision is often referred to as ‘Schrems II’; it requires businesses to carry out country and transfer risk assessments before transferring data from the EU/EEA to countries which are not deemed ‘adequate’, i.e. do not offer an adequate level of protection under the General Data Protection Regulation (GDPR).

SCCs: an explanation

SCCs are model contract clauses that are pre-approved by the European Commission for use in contracts. SCCs were updated in light of the GDPR obligations around data protection and data transfers outside the EU/EEA.

Contract wording for SCCs can be accessed from the European Commission’s site.

How Schrems II fits in

Schrems II is the judgement that obligates companies to undertake country assessments when relying on SCCs to be compliant with international data transfer regulation. It is named after a case, centered around privacy, brought by Maximilian Schrems.

What has changed?

SCCs provide wording for inclusion in contracts to keep them compliant when it comes to data transfers outside the EU/EEA. In June 2021, these were updated by the European Commission. As a result, contracts that include SCCs must be updated.

The deadlines

New contracts have had to include the updated SCCs wording from 27 September 2021.

This year, existing contracts that include the previous version of the SCCs must be updated before 27 December 2022.

What you need to do

All companies impacted by the change to SCCs and the Schrems II decision must act to:

1. Operationalize the new regulations, including a process for transfer risk assessments
2. Remediate existing contracts to include the updated SCCs – before 27 December 2022.

Establish processes to operationalize the new regulations
To comply with the new personal data transfer regulations, companies will need a range of processes in place to, for example, understand cross-border data flows and export jurisdictions and execute transfer impact assessments. A clear and comprehensive communications and training plan will be needed to ensure the process changes are understood, implemented and become a new way of working.

This is an opportune time to assess your business processes for establishing compliant contracts going forward. End-to-end contract lifecycle management maximizes the value of every contract with tools to automate and standardize processes to lower risk and boost compliance, as well as speed up contract management tasks and improve efficiency.

Remediate existing contracts
Most businesses will have hundreds, if not thousands, of contracts. To manually identify those that need to be updated to reflect a change such as the one to SCCs would be unacceptably time-consuming. It would also be particularly error prone. Once all contracts that are impacted have been identified, the specific clauses to amend must be located. The problem is one of contract visibility and the need for an automated solution that can interrogate the contents of contracts to extract the pertinent information.

Contract intelligence technology, with artificial intelligence (AI), takes the jeopardy out of the otherwise onerous task of contract discovery and search. It extracts unstructured text from commercial agreements and organizes it into structured data for action. Add in a human review to validate data accuracy and continually train the AI functionality in order to achieve 100 percent accurate data extraction.

How Conga can help
Conga has partnered with PwC to provide you with the support and guidance to work through each phase of this change. Combining technology and consultative expertise, this partnership can support you with what you need to do to establish processes to operationalize the new regulations, establish effective and efficient contract management, and remediate existing contracts.

For further information, please review information from PwC on EU Standard Contractual Clauses: Time to get stuck into remediation and to find out how we can help, get in touch.