Transition period for new Standard Contractual Clauses to expire on 27 December 2022
Earlier this week the European Commission published its draft adequacy decision for the USA (press release, draft). The proposal introduces a new EU-US Data Privacy Framework (DPF) permitting data transfers from the EU to the United States.
Similar to and in continuation of the former “Privacy Shield”, the new framework will establish a system of certification through which U.S. organisations commit to a set of privacy principles issued by the US Department of Commerce.
The draft will now be reviewed by the European Data Protection Board (EDPB) and the EU Member States. Considering any comments by the EU Member States and the non-binding opinion of the EDPB, the Commission may already issue a legally binding adequacy decision in early to mid-2023.
Once effective, companies will again be able to rely on the adequacy decision as a transfer mechanism. However, data privacy activists have already noted their scepticism and may again challenge the decision before European Courts. If successful, the adequacy decision may once again only see a short life span of two to three years. Therefore, companies may seek to implement back-up and exit-strategies for alternative transfer mechanisms (e.g. Standard Contractual Clauses and Transfer Impact Assessments).
US adequacy decision expected in early to mid-2023 will ease compliance measures for data transfers to the USA – however, longevity is already threatened
Background
Following the invalidation of the former adequacy framework “Privacy Shield” by the Court of Justice of the European Union (CJEU) in mid-2020, data transfers to the USA have been facing legal challenges for the past two years (see our client alert).
In order to address the concerns of the CJEU and after negotiations between the European Commission and the United States, US President Joe Biden issued Executive Order 14086 on ‘Enhancing Safeguards for US Signals Intelligence Activities’ (EO 14086) in October 2022. This EO is complemented by a Regulation on the Data Protection Review Court issued by the U.S. Attorney General (AG Regulation). Collectively these new measures shall provide an adequate level of protection as required by the GDPR and EU fundamental rights of the EU Charta.
“Our analysis has showed that strong safeguards are now in place in the U.S. to allow the safe transfers of personal data between the two sides of the Atlantic. The future Framework will help protect the citizens’ privacy, while providing legal certainty for businesses.” Didier Reynders, Commissioner for Justice – 13/12/2022, EU Commission press release
Mandatory transition to new Standard Contractual Clauses by 27 December 2022
Absent the adequacy decision, companies currently must rely on alternative transfer mechanisms. Most prominently, companies use so-called Standard Contractual Clauses (SCCs), i.e. template contract forms issued by the EU Commission.
In this regard, the European Commission adopted modernised SCCs in June 2021 (see our client alert).
According to this decision, SCCs in their previous versions could no longer be concluded after September 2021. Old SCCs already concluded before this date must be replaced by the “new” SCCs by 27 December 2022, at the latest.
Companies must conclude the new set of Standard Contractual Clauses by 27 December 2022 for compliant GDPR data transfers
While the new clauses offer many benefits and can be implemented for a wider variety of processing situations, the modules, options and annexes must be adapted to each specific case. In practice, the additional effort is compensated by the modernised clauses, as they simultaneously address the requirements of Art 28 GDPR (data processing agreements). Additional provisions or contracts to this effect can therefore regularly be omitted.
However, when drafting the clauses, the level of data protection in the third country must be examined and, if necessary, additional guarantees must be implemented (see clause 14; ECJ in C-311/18, “Schrems II”; and our client alert on supplementary measures).
Download the Article in English
GDPR international data transfers: Commission’s Draft Privacy Shield Replacement
Transition period for new Standard Contractual Clauses to expire on 27 December 2022 Earlier this week the European Commission published its draft adequacy decision for the USA (press release, draft). The proposal introduces a new EU-US Data Privacy Framework (DPF) permitting data transfers from the EU to the United States. Similar to and in continuation […]...
Changes in the Prospectus Regulation
*available in German below Prospectus Regulation: Expiry of facilitations at the end of 31 December 2022 in relation to (i) information requirements for financial intermediaries regarding supplements and (ii) continuous issues; and new proposal for the amendment of the Prospectus Regulation published The measures adopted by the European Commission to address the recovery of capital […]...
Wolf Theiss advises A&M Capital Europe on an add-on acquisition of Zoo Group Stefanov
Sofia, 14 December 2022 – Pet Network International, a portfolio company of European middle-market private equity fund A&M Capital Europe relied on the legal expertise of Wolf Theiss regarding its acquisition of Zoo Group Stefanov, the operator of the most popular pet store chain in Bulgaria. Zoo Group Stefanov is a leading pet-care store chain […]...
Ukraine: new developments in the employment regime for foreign citizens
Ukraine continues to gradually reform and streamline regulations regarding the employment of foreign citizens in Ukraine. On 15 October 2022, the Law of Ukraine “On Amendments to Certain Laws of Ukraine Concerning the Employment of Foreigners and Stateless Persons in Ukraine and the Provision of Employment Intermediary Services Abroad” (the “Law”) became effective. The Law […]...
Comparative Legal Guides – Foreign Direct Investment Regimes 2023
Country Chapters for Czech Republic, Hungary, Poland and Romania These quick reference country chapters on Czech Republic, Hungary, Poland and Romania designed in an easy-to-access Q&A format provide practitioners with detailed legal information on the developments in foreign direct investment screening regimes. Covered Topics include key questions such as: Are there any current proposals to […]...
ÖBB subsidiary Rail Tours acquires strategic stake in railtour suisse with legal counsel from Wolf Theiss
Vienna, 9 December 2022 – Wolf Theiss successfully advised ÖBB subsidiary Rail Tours Touristik GmbH (“Rail Tours”) on the acquisition of a strategic stake in Swiss rail tour operator railtour suisse sa from DER Touristik Suisse SA. Under the lead of partner Clara Gordon (Corporate/M&A), Wolf Theiss represented ÖBB subsidiary Rail Tours in acquiring 33.4% […]...
The Insolvency Review 2022 – Austria & Hungary
The Insolvency Review offers an in-depth review of the most consequential features of the insolvency laws and procedures in key jurisdictions worldwide. It also examines the practical implications of recent market trends and insolvency case developments. This 10th edition of The Insolvency Review once again offers an in-depth review of market conditions and insolvency case […]...
Data protection in the recruitment process
In this episode of our Arbeitsrecht podcast, Magdalena Ziembicka and Paulina Pomorski look at questions related to data protection in the job application process: from general issues of processing applicants’ personal data, background checks and obtaining references to the use of algorithms in the application process and processing and storing application records. EPISODE SUMMARY In […]...
Wolf Theiss advises GalCap Europe on the acquisition of its first historic tenement building in Vienna
Vienna, 6 December 2022 – GalCap Europe has purchased a trophy asset next to Vienna’s famous Augarten baroque park. This “Foundation Period House” was completely renovated and modernised with an elegant attic conversion. Located close to the Augarten in Vienna, the modernised apartment building encompasses a total lettable area of about 1.900 sqm. and generous […]...
Wolf Theiss advises Elvaston on acquisition of Gastrodat Group
Vienna, 03 December 2022 – Wolf Theiss advised Elvaston Capital Management, a German private investment firm, on the legal aspects of the acquisition of Gastrodat Group. Wolf Theiss advised Elvaston with respect to all legal aspects of the transaction from an Austrian legal perspective. Gastrodat Group develops hotel software solutions and provides interface solutions (e.g. […]...
Not your keys, not your coins
How safe are customers’ crypto assets in the insolvency of their crypto custodian? This article is also available in German below The bankruptcy of the crypto exchange FTX is a dramatic turn of events for the blockchain world and has further damaged confidence in the crypto market. Not only institutional investors have been affected. Many […]...
Wolf Theiss advises Horn Grundbesitz KG on acquisition of hotel and office property in Vienna
Vienna, 1 December 2022 – Horn Grundbesitz KG of Germany has purchased a trophy asset in Vienna’s third district from CA Immobilien AG. The building complex includes the ‘Hotel Savoyen’ and an office building. Closing of the deal is expected to occur in early 2023. Located close to the Belvedere Palace in Vienna, the property […]...