Data Protection Update: Standard Clauses, Brexit and Examples for Breach Notifications

The European Data Protection Board has said that the new draft standard clauses for: 

• contracts between controllers and processors within the EEA; and 
• the transfer of personal data to non-EEA countries, 

are not quite right. Tweaks are needed. 

The new draft clauses for non-EEA transfers remain very important in the Brexit context. While the EU-UK trade deal contains a ‘bridging mechanism’ to allow the continued free flow of personal data from the EEA to the UK for up to 6 months, pending a potential EU adequacy decision in favour of the UK data protection regime, that ‘bridge’ comes with conditions that the UK might conceivably breach; and an adequacy decision is not assured.  

Meanwhile the EDPB is also consulting until 2 March on the Examples for giving notifications of data breaches.

---

Contributing Advisors