The United Kingdom’s Information Commissioner’s Office has issued guidance for public consultation on cross-border transfers of personal data from the UK to third countries without an adequacy decision, replacing the old Standard Contractual Clauses (SCCs) which are currently in use for such transfers.
According to the ICO press release, “the new guidance has been designed to be accessible and to ensure they support all organizations, from (small and medium-sized enterprises) without the benefit of large legal budgets to multi-national companies”
The guidance has three documents:
– Guidance on conducting Schrems TIAs
– Guidance on International Data Transfer Agreements
– Addendum to new SCCs
My thoughts on the first two are forthcoming.
But regarding the SCCs: The ICO endorses use of the new SCCs issued by the European Commission subject to the use of an addendum which applies the clauses to UK-third country transfers, subjecting them to ICO/UK court jurisdiction.
Read the full draft here: