Standard contractual clauses for cross-border transfers of health data after Schrems II. Issue 1 (21st June 2021)

• Record Type: Journal Article
• Authors: Bradford, Laura; Aboy, Mateo; Liddell, Kathleen
• Is Part Of: Journal of law and the biosciences. Volume 8:Issue 1(2021)
• Publication Date: 2021-06-21
• Subjects: GDPR -- privacy and data protection -- cross-border transfers -- EU-US Privacy Shield -- standard contractual clauses -- appropriate safeguards -- health data -- medical research; Life sciences -- Law and legislation -- Periodicals; Science and law -- Periodicals; Law and biology -- Periodicals; Biotechnology -- Law and legislation -- Periodicals; Bioethics -- Periodicals; 344.0957
• DOI: 10.1093/jlb/lsab007
• Languages: English
• ISSNs: 2053-9711

Abstract

Abstract: Standard contractual clauses (SCCs) have long been considered the most accessible method to transfer personal data legally across borders. In July 2020, the Court of Justice of the European Union (CJEU) in Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems ( Schrems II ) placed heavy conditions on their use. The Schrems II Court found that SCCs were valid as 'appropriate safeguards' for data transfers from EU entities to others outside the EU/EEA as long as unspecified 'supplementary measures' were in place to compensate for the lack of data protection in the third country. Data protection officers are under intense pressure to explain these measures and allow routine transfers to continue. Some authorities interpret the decision as preventing the use of SCCs to transfer personal data outside of the EU because private contracts cannot comprehensively redress gaps in national law. This article argues that these authorities are mistaken and that notwithstanding Schrems II SCCs can still be useful instruments for cross-border transfers. This is especially true in highly regulated contexts such as medical research. This paper traces the history of SCCs under the General Data Protection Regulation (GDPR) and shows how the CJEU in Schrems II misunderstood the purpose of SCCs and other Article 46 GDPR 'appropriate safeguards'. The CJEU mistakenly approached Article 46 safeguards such as SCCs as being similar to country-specific adequacy rulings under Article 45 GDPR. But unlike Article 45 adequacy rulings, SCCs were not intended to provide a stand-alone mechanism for transfer reliant on the law of the importing country. Rather SCCs provide an alternative, multi-layered standard for data protection that encompasses law, technology and organizational commitments. Their purpose is to be used in situations where legislation alone is insufficient to protect data subject rights. The European Commission's new draft SCCs support this analysis.