EDPB and EDPS adopt joint opinion on the new draft SCCs

On 15 January 2020, the European Data Protection Supervisor ("EDPS") and the European Data Protection Board ("EDPB") issued a press release announcing their adoption of a joint opinion on the draft new standard contractual clauses ("draft SCCs") published by the European Commission in November 2020. The opinions covered both international transfers ("International SCCs") and controller-processor relationships within the European Economic Area ("EEA") ("Controller-Processor SCCs").

International SCCs

Both the EDPS, Wojciech Wiewiórowski, and the EDPB Chair, Andrea Jelinek, welcomed the International SCCs, particularly the provisions included by way of response to the Schrems II Judgment providing a level of reinforced protection for data subjects and safeguards in cases where the laws of countries could impact the ability of any persons to comply with the obligations of the clauses.  However, the bodies commented that these International SCCs do not constitute a complete fix for all the issues raised by the judgement. The EDPB and EDPS identified a number of areas in the International SCCs requiring clarification such as their intended scope together with provisions relating to "certain third party beneficiary rights; obligations regarding onward transfers; aspects of the assessment of third country laws regarding access to public data by public authorities; and the notification to the supervisory authority."

Controller-Processor SCCs

The Controller-Processor SCCs were similarly welcomed “as a single, strong and EU-wide accountability tool that will facilitate compliance." However, certain clarifications were requested, essentially with a view to ensuring the Controller-Processor SCCs meet the intended aim of harmonization and legal certainty and operate as an effective accountability tool.  As well as increased precision around the relationship, roles and responsibilities of controllers and processors with regards to each processing activity, the bodies identified the "docking clause" (which gives additional parties the opportunity to accede to draft SCCs) as a particular area requiring attention.

So what's next?

It is worth noting that the submission of the joint opinions by the EDPS and EDPB was part of a wider public consultation process following the publication of the draft SCCs in November of last year - we have already seen certain other organizations publish critiques and recommended improvements to the draft SCCs and there are no doubt others.  The fate of the draft SCCs is now in the hands of the European Commission and its final decision on standard contractual clauses. On a procedural note, the EDPB and EDPS suggested the European Commission consider the final form of the Recommendations on Supplementary measures (once adopted) alongside their review of the draft SCCs given the importance of the supplementary measures in the new age of international data transfers post Schrems II.