Locations
The EU is poised to grant data adequacy to the UK, removing the need for businesses to put in place additional measures – and incur significant additional costs – to continue to transfer data between the EU and the UK. However, there is another significant data protection event and challenge on the horizon, the anticipated publication of new standard contractual clauses (SCCs) later this year, which results in the repeal of the current SCCs.
"An assessment of the economic impacts of the UK being deemed a third country by the EU suggested that the cost to business of putting in place measures such as SCCs to facilitate the flow of personal data between the EU and the UK, could be between £1bn and £1.6bn," said James Buckingham, a Partner at European law firm, Fieldfisher.
"The cost to business in the EU, UK and beyond of re-papering all contracts that use the current SCCs will be significantly higher."
SCCs are a widely used mechanism to allow for the transfer of personal data to third countries in accordance with the GDPR. The current standard contractual clauses, developed under the previous data protection regime, were not updated when the GDPR came into force in May 2018. As a result, there are a number of issues between the SCCs, applicable law and current practice. The new SCCs were not adopted before the end of the Brexit transition period and it is unclear whether the UK will adopt the new SCCs or will implement with some variations, though it is known that the UK Information Commissioner's Office is currently reviewing the new SCCs.
"For organisations that rely on SCCs to transfer personal data outside the UK and the EU, the requirement to re-paper those contracts within the 12-month grace period will be burdensome both in time and cost. Large organisations are likely to need to address hundreds, if not thousands, of contracts that will need to be identified, reviewed, assessed and then repapered with new SCCs," said Mr Buckingham.
The repeal and replacement of the current SCCs requires businesses to locate and review contracts to find those that rely on the current SCCs. Where contracts are impacted, the new SCCs will need to be prepared, negotiated and agreed with the counterparties. Businesses are likely to require support to complete this exercise due to sheer number of contracts that are affected.
"The repeal and replacement of SCCs creates a significant business challenge, that businesses need to prepare for now," said Mr Buckingham. "In-house legal teams should start to prepare for the SCC re-papering exercise by mapping all data flows to determine which contracts are affected and which of the four versions of the new SCCs they need to implement once the new SCCs are adopted.
"We are already scaling up resources within Fieldfisher's alternative legal solutions business, Condor to accommodate this task for a number of clients, combining Fieldfisher's legal expertise with technology and paralegals to meet our clients' requirements for a cost-effective and scalable legal service delivery."
Condor is already well-versed in repapering exercises having successfully completed GDPR and other re-papering projects for clients involving the remediation of hundreds or thousands of contracts, managing the end to end process.
"This is an issue that is currently under the radar but companies need to be aware that it is coming and to prepare for it," added Mr. Buckingham.
ENDS
About Fieldfisher
Fieldfisher is a European law firm with market leading practices in many of the world's most dynamic sectors. We are an exciting, forward-thinking organisation with a particular focus on technology, finance & financial services, energy & natural resources, life sciences and media.
Its European network of offices supports an international client base alongside our Silicon Valley and China colleagues. Clients choose to work with us because we deliver commercial, pragmatic and innovative solutions through our exceptional legal expertise and experience, on time and on budget.
Our network has more than 1,900 people working across 25 offices providing highly commercial advice based on an in-depth understanding of our clients' needs.
We operate across our offices in Amsterdam, Barcelona, Beijing, Belfast, Birmingham, Bologna, Brussels, Dublin, Düsseldorf, Frankfurt, Guangzhou, Hamburg, London, Luxembourg, Madrid, Manchester, Milan, Munich, Paris, Rome, Shanghai, Turin, Venice and Silicon Valley.