Standard contractual clauses for cross-border transfers of health data after Schrems II

Abstract

Standard contractual clauses (SCCs) have long been considered the most accessible method to transfer personal data legally across borders. In July 2020, theCourt of Justice of the EuropeanUnion (CJEU) inData Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Schrems II) placed heavy conditions on their use. The Schrems II Court found that SCCs were valid as appropriate safeguards for data transfers from EU entities to others outside theEU/EEAas long as unspeci_ed supplementary measures were in place to compensate for the lack of data protection in the third country. Data protection o_cers are under intense pressure to explain these measures and allow routine transfers to continue. Some authorities interpret the decision as preventing the use of SCCs to transfer personal data outside of the EUbecause private contracts cannot comprehensively redress gaps in national law. This article argues that these authorities are mistaken and that notwithstanding Schrems II SCCs can still be useful instruments for cross-border transfers. This is especially true in highly regulated contexts such as medical research. This paper traces the history of SCCs under the General Data Protection Regulation (GDPR) and shows how the CJEU in Schrems II misunderstood the purpose of SCCs and other Article 46 GDPR appropriate safeguards . The CJEU mistakenly approached Article 46 safeguards such as SCCs as being similar to country-speci_c adequacy rulings under Article 45 GDPR. But unlike Article 45 adequacy rulings, SCCs were not intended to provide a stand-Alone mechanism for transfer reliant on the law of the importing country. Rather SCCs provide an alternative,multi-layered standard for data protection that encompasses law, technology and organizational commitments. Their purpose is to be used in situations where legislation alone is insu_cient to protect data subject rights. The European Commission s new dra_ SCCs support this analysis.