December 1, 2022

Volume XII, Number 335


December 01, 2022

Subscribe to Latest Legal News and Analysis

November 30, 2022

Subscribe to Latest Legal News and Analysis

November 29, 2022

Subscribe to Latest Legal News and Analysis

November 28, 2022

Subscribe to Latest Legal News and Analysis

The ‘Other SCC’: June 4, 2021 EU Commission Decision on Data Processing Agreement Standard Contractual Clauses

So much has been said about the new Cross-Border standard contractual clauses (SCC), which the EU Commission finally adopted on 4 June 2021, that it almost went unnoticed that the Commission published two different kinds of SCC that day. The other set of SCC (the DPA-SCC) addresses controller-processor data processing agreements (that do not necessarily involve cross-border transfers).

What are DPA-SCC, and to which situations do they apply?

As with the Cross-Border SCC, the EU Commission had published a draft of the DPA-SCC for public consultation in November 2020 (for details, see GT blog post from 18 November 2020). The background for the DPA-SCC, which do not have a predecessor under the EU data protection directive, is that Article 28(3) GDPR provides for several mandatory elements to be included in data processing agreements (DPAs) between a controller and a processor, and Article 28(7) GDPR permits the Commission to “lay down standard contractual clauses” for such DPAs. So that is what the new DPA-SCC are: They provide a template that standardizes the data-protection-related rights and obligations of the respective parties in DPAs and that ensures GDPR compliance if used correctly.

Note: The DPA-SCC are not mandatory, i.e., parties can use other provisions in their DPA if they comply with Article 28(3) GDPR, and also (and different from the Cross-Border SCC), the DPA-SCC may be amended. Also, while the Cross-Border SCC address data transfers to non-EU and non-EEA countries (third countries), including between controllers and processors, the DPA-SCC can only be used for data transfers inside the EU/EEA. In this respect, they follow a different approach and are shorter and simpler.

What are the key takeaways?

  • Unlike with the Cross-Border SCC, the European Commission had not previously provided standard clauses for contractual relations between controllers and processors, so the DPA-SCC are a novelty (at the EU level) and not “merely” an update. While in the past, some national data protection laws provided for quite specific provisions to be included in DPAs, and some national data protection authorities had provided DPA templates, the DPA-SCC apply at the European level and thus no longer require an analysis of national decisions.

  • Controllers and processors may use the new DPA-SCC to comply with Article 28 GDPR. Hence, the DPA-SCC are particularly convenient for companies with lower administrative capacities that have not yet established their own GDPR-compliant “standard” DPA.

  • If, however, data is exported to third countries, the DPA-SCC alone are not sufficient to ensure that the processing is lawful. On the other hand, the Cross-Border SCC contain the required provisions of a DPA pursuant to Article 28 GDPR, so in these cases the use of the Cross-Border SCC is sufficient.

How are the DPA-SCC used?

The DPA-SCC consist of two parts, namely the contractual clauses themselves, which (subject to a few options) should not be modified, and four annexes, which need to be completed individually by the parties. Of course, other than with the Cross-Border SCC, parties do not have to use the DPA SCC for their data processing arrangements. However, the big advantage of using them is that the parties can be sure that their data processing agreement will be compliant with the requirements of Article 28 GDPR – a benefit that is lost if the “mandatory” parts are changed.

Annex I names the parties. Annex II includes descriptions of the respective processing (e.g., categories of data subjects and data processed). Note that the EU Commission removed some particularly far-reaching mandatory elements that were still included in the last draft version (e.g., “records(s) of processing” and “place of storage and processing of data”). Annex III lists the technical and organizational measures regarding data security implemented by the data processor. These need to be described in detail, not generically. A list of possible measures is provided, including, for example, pseudonymisation and encryption of personal data, measures for internal IT and IT security governance and management, and measures to protect personal data during transmission. Also, if sub-processors are used, specific technical and organisational measures to be taken by that sub-processor must be described. The selection, implementation, and description of such measures will require less preparatory work than is required for the Cross-Border SCC, as no third-country legislation and other risks that follow from a transfer of data to a third country need to be assessed. Annex IV names sub-processors, including the scope of their sub-processing.

What might cause confusion: The DPA-SCC apply both to data processing agreements that are subject to GDPR, as well as to data processing agreements subject to Regulation (EU) 2018/1725, which is “the GDPR for EU institutions”. Hence, there are a number of alternatives in the DPA-SCC that only apply if they are used by an EU institution (and otherwise need to be deleted).

When do the new DPA-SCC enter into force?

Like the Cross-Border SCC, the DPA-SCC have been applicable since 27 June 2021. As the DPA-SCC are not mandatory, existing (and future) DPAs remain effective if they meet the requirements under GDPR.

©2022 Greenberg Traurig, LLP. All rights reserved. National Law Review, Volume XI, Number 274

About this Author

Viola Bensinger, Greenberg Traurig Law Firm, Germany, Cybersecurity Litigation Attorney

Viola Bensinger chairs the Technology Practice as well as the Litigation Practice in Germany. She advises clients from the technology, media and healthcare industries.

Within the technology sector, Viola advises international internet, technology and healthcare companies in the areas of digital products, e-commerce, electronic payment, data protection, software licensing, (IT-) outsourcing as well as digital media.

49 -030700-171-150
Jannis Dietrich Germany Technology Data Cyber Associate Attorney Greenberg Traurig LLP

Jannis Dietrich advises national and international companies on issues concerning the internet, technology, data protection, digitization and litigation. He combines his legal experience with his technical knowledge as a certified electronic technician for IT systems and consequently is now skilled in the interface of law and technology. The key areas of his practice are IT, copyright and licensing law, advice on digital and blockchain-based business models, as well as data protection, competition and consumer protection law.

+49 0 30 700 171 214