On June 4, 2021, the European Commission published the final version of the implementing decision on standard contractual clauses (“SCC”) for transfers of personal data to third countries under the EU General Data Protection Regulation (“GDPR”). The Commission also released the final version of the new SCCs. (LINK) The new version of the SCCs is in part a response to the decision in the Schrems II case, which raised questions about whether they provide necessary protections for the trans-Atlantic transfer of data. The European Commission’s release in November 2020 of draft versions of the implementing decision and the SCCs was discussed previously in this blog.
The guidance makes clear that companies using SCCs will face new compliance challenges. The implementing decision makes the important point that the controllers and processors will need to do more in advance of signing them. To fulfill SCC requirements, companies – whether data importers or data exporters – will need to understand the nature and extent of the data being transferred and the and establish protections necessary to comply with the requirements of the SCCs. Stated simply, companies will need to conduct a data protection impact assessment to understand what risks the transfer of data will raise and take steps to address them.
Companies will also need to document the steps it takes to fulfill the requirements of the SCCs.
The implementing decision also imposes significant additional requirements:
- The controller and processor should be able to demonstrate compliance;
- The importer should maintain appropriate documentation for the processing activities for which it is responsible;
- The data importer should be required to inform the data exporter promptly if it is unable to comply with the clauses, for whatever reason; and
- Should the data importer breach the clauses or be unable to comply with them, the data exporter should end the transfer of data and, in serious cases, have the right to terminate the contract, as it concerns the processing of personal data under the SCCs.
Clearly decision means organizations have to take far more significant action than previously. SCCs are intended to ensure that organizations implement appropriate data protection safeguards for international data transfers. Therefore, the controller or processor transferring the personal data to a third country (the ‘data exporter’) and the controller or processor receiving the personal data (the ‘data importer’) can incorporate those standard contractual clauses in a wider contract and add other clauses or additional safeguards, provided they do not contradict the standard contractual clauses or prejudice the fundamental rights or freedoms of data subjects. Controllers and processors are encouraged to provide additional safeguards by means of contractual commitments that supplement the standard contractual clauses.
All old SCCs likely will need to be replaced with the new SCCs, at the latest, by approximately December 2022. For many organizations with a large number of contractual relationships, that means time is of the essence.
Michael C. Barnes, JD, and Stacey L. Worthy, JD, both Principal Attorneys at Sequel Legal, are slated to speak at the 2021 North Carolina Prevention Conference. Mr. Barnes will co-present with David Ezzell, MPA, Education Consultant and Paramedic with the North Carolina Office of Emergency Medical Services. Their presentation, entitled, “Community Paramedicine: Mobilizing Resources in Support of Prevention,” will examine avenues for community collaboration, types and examples of community paramedicine programs, and the application of community paramedicine programs to substance misuse prevention.
Ms. Worthy will co-present with Anna Godwin, MS, LCAS, CSAPC, CEO of Community Impact NC. Their presentation, “CBD, Delta-8-THC, and Marijuana Law and Policy: An Objective Discussion,” will look at law and policy surrounding CBD, hemp, and marijuana; legal definitions and their applicability to CBD and delta-8 THC products; consumer awareness; and factors to consider as North Carolinians evaluate their own marijuana policy.
The 2021 North Carolina Prevention Conference will take place virtually June 15-16.
Michael C. Barnes, JD, Principal Attorney at Sequel Legal and Chairman of the Center for U.S. Policy, will speak at the American Pharmacists Association (APhA) 2021 Institute on Substance Use Disorders on Tuesday, June 1. Mr. Barnes will update his presentation from the APhA 2021 Annual Meeting entitled “Don’t ‘Just Say No’: Preventing Diversion and Addressing Medical Needs.” He will co-present with Jake Nichols, PharmD, CEO of Professional Recovery Resources. Mr. Barnes will provide an overview of federal and state laws relevant to a pharmacist’s decision on whether to dispense a controlled medication, including the federal Controlled Substances Act, state mandatory consultation or refusal laws, and professional licensing board rules. He will also summarize recent litigation of interest to pharmacists who dispense controlled medications. The APhA Institute on Substance Use Disorders will take place online June 1-4.
Michael C. Barnes, JD, at Sequel Legal and Chairman of the Center for U.S. Policy, will moderate three separate sessions at the 2021 Rx Drug Abuse & Heroin Summit. Topics will include informed addiction policy, post-overdose interventions, and addressing social determinants of health in addiction treatment. The annual conference will take place online April 5-8. Registration for 2021 Rx Summit is still open, and the full agenda is available online.
The sessions Mr. Barnes will moderate are as follows:
- From Outreach to Outcomes: A Call for Consistent Measures Across Post-Overdose Outreach Interventions, Monday, April 5
- Building a Diverse and Informed Bench in Addiction Policy, Tuesday, April 6
- Addressing Social Determinants of Health in Addiction Treatment, Wednesday, April 7
Michael C. Barnes, JD, at Sequel Legal and Chairman of the Center for U.S. Policy, will speak at the American Pharmacists Association (APhA) 2021 Annual Meeting on Monday, March 15. Mr. Barnes will co-present the session, entitled “Don’t ‘Just Say No’: Preventing Diversion and Addressing Medical Needs,” with Jake Nichols, PharmD, CEO of Professional Recovery Resources. Mr. Barnes will provide an overview of federal and state laws relevant to a pharmacist’s decision on whether to dispense a controlled medication, including the federal Controlled Substances Act, state mandatory consultation or refusal laws, and professional licensing board rules. The APhA Annual Meeting will take place online March 12-15.