The European Commission consulted stakeholders on draft implementing decision on standard contractual clauses (“SCC”) for the transfer of personal data to third countries. AFEP, which supports the Commission’s work on the SCC remaining GDPR compliant, nevertheless stress that this must go hand in hand with smooth global data flows. They raise serious concerns:
- On the disproportionate and non-GDPR-compliant burden placed on private actors in the analysis of the legal framework and practices of third countries;
- On the date of entry into force of these decisions (one year after their entry into force), which leaves too short a period for private actors to implement these measures.
AFEP therefore asks for:
- a real impact study to be carried out on the changes made by this project,
- a postponement of implementation from 1 to 3 years
- no retroactivity, as it could undermine the legal security of companies. New clauses should be exclusively targeting new contracts (or existing contracts when they expire or have to be renewed).