What is new?
During the ICO’s Data Protection Practitioners’ Conference 2021 today, the ICO revealed that it is working on new Standard Contractual Clauses (SCCs) to facilitate transfers of personal data outside the UK. The ICO’s consultation on the new UK SCCs will take place this summer. This is a separate process to the new SCCs that are currently being finalised by the European Commission. These new EU SCCs will not be valid for use for restricted transfers of data outside the UK.
Why is this change taking place?
From 31 December 2020 organisations in the UK have been relying on existing SCCs (Decisions 2001/497/EC and 2010/87/EU) for transfers of data outside the UK except where such territories are recognised as adequate (e.g. countries in the EU, the EEA, and those that obtained the EU Commission’s adequacy decision). However, the existing SCCs will be repealed when the new EU SCCs come into play. Therefore, the ICO is taking measures to put in place new international transfer mechanisms for restricted transfers outside the UK.
How will the UK SCCs differ from the EU SCCs?
This remains to be seen as the draft has not been published yet. Our take is the new UK SCCs are unlikely to be substantially different from the EU SCCs. First of all, the ICO already made it clear that any transfers to third countries will need to take into account the Schrems II decision and apply supplementary measures, where required. Therefore, the new UK SCCs are likely to contain Schrems II clauses which the draft EU SCCs also have.
Secondly, the UK is awaiting an adequacy decision from the European Commission for free transfers of personal data from the EU/EEA to the UK. The draft adequacy decision from the European Commission, which we previously wrote about here, does not allow the UK to deviate from the protections guaranteed by the EU GDPR. Despite the transfer tools being broadly the same, organisations are facing a prospect of having separate SCCs for transfers to third countries from the EU/EEA and from the UK.
Organisations in the EU will have a year within which they will be able to continue to rely on the existing SCCs and use that time to transition to the new EU SCCs. It is likely that the ICO will give organisations equally sufficient time to transition to the new UK SCCs.
Next Steps
The ICO intends to publish draft UK SCCs for public consultation in summer 2021. In the meantime, organisations can continue to rely on the current SCCs for restricted transfers outside the UK. Keep an eye out for our future blog posts where we will monitor and report on the ICO’s final set of UK SCCs.