The UK’s ICO launches public consultation on new Standard Contractual Clauses

0
31

In our previous post here, we discussed the ICO’s announcement that it was working on new Standard Contractual Clauses (SCCs) to facilitate the transfer of personal data outside of the UK. The new UK SCCs will be known as the UK’s International Data Transfer Agreement (IDTA).

The ICO has now started the public consultation on its IDTA and accompanying guidelines (available here). The consultation is open for feedback until October 7, 2021, 5 p.m.

Purpose of the IDTA

IDTA will replace the current UK SCCs. The ICO has already made it clear that the Schrems II decision must be taken into account in the case of transfers to third countries and, if necessary, additional measures must be taken. The IDTA is a contract that organizations can use when making a “restricted transfer”. The ICO is also advising how a “restricted transfer” can be defined in the light of the UK GDPR. In particular, the ICO is advising whether its current guidelines should be retained, according to which a restricted transfer only takes place if the processing of the personal data by the importer is not subject to the UK GDPR. ICO Executive Director of Regulatory Strategy, Steve Wood, recognizing the complexities of international transfers for businesses, said the new guidelines are accessible and intended to support the full range of organizations, from SMEs to multinational corporations.

Advice

The consultation is divided into three sections, including:

  1. Proposal and plans to update its guidelines on international credit transfers;
  2. Transfer Risk Assessments (TRA). The ICO outlines a three-step TRA tool designed to help organizations conduct routine restricted remittances. The TRA tool provides a list of questions to work on and tables to help the organization assess risk at each step.
  3. The International Data Transfer Agreement and a helpful addendum that can be used with international data transfer agreements from other jurisdictions, including the EU, New Zealand, and the Association of Southeast Asian Nations.

Next Steps

The ICO has encouraged all organizations that handle international remittances and other interested parties such as data protection practitioners and lawyers to participate in the consultation and provide feedback. All feedback received feeds into the work of the ICO in developing the final documents and helps ensure that the final version of the transfer tools works effectively in practice.

If you are interested in responding to the consultation, you can download and complete the consultation paper and questionnaire from the ICO website here and email it [email protected]. Keep an eye out for our future blog posts where we will cover the final documents.