EDPB-EDPS Joint Opinion 2/2021 on standard contractual clauses for the transfer of personal data to third countries

EDPB - EDPS Joint Opinion 2 /2021 on the European Commission’s Implementing Decision on standard contractual clauses for the transfer of personal data to third countries for the matters referred to in Article 46(2)(c) of Regulation (EU) 2016/679 Adopted

4 The European Data Protection Board and the European Data Protection Supervisor Having regard to Article 42(2) of the Regulation 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 1 , HAVE ADOPTED THE FOL LOWING JOINT OPINION 1 BACKGROUND 1 In compliance with Article 44 of Regulation (EU) 2016/6 79 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data 2 (“ GDPR ”), any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if the conditions laid down in Chapter V GDPR are complied with by the controller and processor, including for onward transfers of personal data from the third country or an international organisation to another third country or to another international organisation. In particular, in the absence of an adequacy decision, any transfer should be based on appropriate safeguards listed in Article 46 GDPR. 2 Standard data protection clauses adopted by the European Commission (or the “ Commission ”) in accordance with the examination procedure referred to in Article 93(2) GDPR (“ SC Cs ”) are one of the appropriate safeguards listed by Article 46 GDPR.

In order to be valid, SCCs must incorporate effective mechanisms that make it possible, in practice, to ensure compliance with the level of protection required by EU law and that transfe rs of personal data pursuant to these clauses are suspended or prohibited in the event of the breach of such clauses or if it is impossible to honour them 3 . 1 References to “Member States” made throughout this opinion should be understood as references to “EEA Member States”. 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); OJ L 119, 04.05.2016, p. 1 – 88. 3 Judgment of the Court (Grand Chamber) of 16 July 2020; Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems; Case C - 311/18; para 137 Adopted 5

On 15 June 2001, the Commission adopted Decision 2001/497/EC on standard contractual clauses for th e transfer of personal data to third countries, under Directive 95/46/EC 4 , as amended by Commission Implementing Decision (EU) 2016/2297 of 16 December 2016

(“ the 2004 SCCs ”). 5 On 5 February 2010, the Commission adopted Decision 2010/87/EU on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC 7 , later amended by Commission Implementing Decision (EU) 201 6/2297 of 16 December 2016 8 (“ the 2010 SCCs ”). 6 On 16 July 2020, the Court of Justice of the EU (“ CJEU ” or “ the Court ” ) ruled that the examination of the 2010 SCCs in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights disclosed nothing to affect the validity of that decision (“ the Schrems II ruling ”) 9 .

In the same case, the CJEU also provided for additional clarifications on the use of SCCs. In particular, the CJEU ruled that data subjects whose personal data are transferred to a third country pursuant to standard data protection clauses should be afforded, as in the context of a transfer based on an adequacy decision, a level of protection essentially equivalent to that which is guaranteed within the European Union 10 .

The CJEU added tha t “[s]ince by their inherently contractual nature standard data protection clauses cannot bind the public authorities of third countries [...] it may prove necessary to supplement the guarantees contained in those standard data protection clauses.” 11 . 4 2001/497/EC: Commission Decision of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC; OJ L 181, 04.07.2001, p. 19 - 31. 5 Commissio n Implementing Decision (EU) 2016/2297 of 16 December 2016 amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses for the transfer of personal data to third countries and to processors established in such countries, under Directive 9 5/46/EC of the European Parliament and of the Council; OJ L 344, 17.12.2016, p. 100 – 101. 6 2004/915/EC: Commission Decision of 27 December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries; OJ L 385, 29.12.2004, p. 74 – 84. 7 2010/87/: Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Di rective 95/46/EC of the European Parliament and of the Council; OJ L 39, 12.2.2010, p. 5 – 18. 8 Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses for the transfe r of personal data to third countries and to processors established in such countries, under Directive 95/46/EC of the European Parliament and of the Council; OJ L 344, 17.12.2016, p. 100 – 101.

Judgment of the Court (Grand Chamber) of 16 July 2020; Data P rotection Commissioner v Facebook Ireland Limited and Maximillian Schrems; Case C - 311/18; para 149.

Ibid, para 132 Adopted 6 9 Conse quently, on 10 November 2020, the EDPB adopted its Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (“ the EDPB Recommendations on supplementary measures ”) 12 . 10 On

November 2020, the Commission published:  A draft Commission Implementing Decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“ the Draft Decision ”); and  A draft Annex to the Commission Implementing Decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (“ the Draft SCCs ” ). 11 The Draft Decision plans to repeal the 2001, 2004 and 2010 SCCs. 12 The Draft SCCs combine general clauses with a modular approach to cater for various transfer scenarios. In addition to the general clauses, controllers and processors shou ld select the module applicable to their situation among the four following modules:  Module O ne: transfer controller to controller;  Module T wo: transfer controller to processor;  Module T hree: transfer processor to processor;  Module Four: transfer proce ssor to controller.

In this context, on 12 November 2020, the Commission requested the EDPB and the EDPS to issue a J oint O pinion on the Draft Decision and the Draft SCCs (“ the Joint Opinion ”), in compliance with Article 42(2) of Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (“ EUDPR ”) 13 . 2 GENERAL REASONING RE GARDING THE DRAFT DE CISION AND THE DRAFT SCC s 2.1 General structure and methodology of the Joint Opinion

First, for the sake of clarity, the Joint Opinion comprises (i) a core part detailing general comments the EDPB and the EDPS wish to m ake and (ii) an annex where additional comments of a more technical nature are made directly to the Draft SCCs , notably in order to provide some examples of possible amendments. There is no hierarchy between the general comments and the technical ones. 12 https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymea surestransferstools_en.pdf . 13 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection o f natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC; O J L 295 , 21.11.2018, p. 39 – 98 . Adopted 7

Third, for the sake of consistency, where needed, cross - references are also made to t he Joint Opinion of the EDPB and the EDPS on standard contractual clauses between controllers and processors under Article 28(7) GDPR and Article 29(7) EUDPR. 2.2 General presentation of the Draft Decision and Draft SCCs and interplay with the EDPB Recommenda tions on supplementary measures

Following up on the EDPB contribution for the evaluation of the GDPR under Article 97 GDPR 14 , the EDPB and the EDPS welcome the fact that this update of existing SCCs intends to:  Bring the SCCs in line with new GDPR requirements 15 .  Better reflect the widespread use of new and more complex processing operations often inv olving multiple data importers and data exporters, long and complex processing chains , as well as evolving business relationships. This means covering additional processing and transfer situations and us ing a more flexible approach, for example with respec t to the number of parties able to join the contract 16 .  Provide for specific safeguards to address the effect of the laws of the third country of destination on the data importer’s compliance with the clauses, and in particular how to deal with binding requests from public authorities in the third country for disclosure of the personal data transferred 17 .

In particular, the EDPB and the EDPS welcome the specific provisions intending to address some of the main issues identified in the Schrems II ruling, a nd in particular the provisions of the Draft SCCs on:  T hird country’s laws affecting compliance with the Draft SCCs (Section II - Clause 2);  A ccess requests received by the data importer and issued by third co untry’s public authorities (Section II - Clause 3); and  O ptional ad - hoc redress mechanism to the benefit of data subjects (Section II - Clause 6).

In this context, the EDPB and the EDPS recall that the EDPB Recommendations on supplementary measures wi ll remain relevant to be applied after the adoption of the Draft SCCs. In particular, the 14 https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_contributiongdprevaluation_20200218.pdf . 15 Draft Commission Implementing Decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council; Recital 6. 16 Ibid, Recital 6. 17 Ibid, Recital 18. Adopted 8 EDPB and the EDPS call on the Commission to clarify that there may still be situations where, despite the use of the new SCCs, ad - hoc supplementary measures will rema in necessary to be implemented in order to ensure that data subjects are afforded a level of protection essentially equivalent to that guaranteed within the EU. As such , the new SCCs will have to be used along with the EDPB Recommendations on supplementary measures. The EDPB and the EDPS invite the European Commission to refer to the final version of the EDPB Recommendations on supplementary measures, should the final version of the Recommendations be updated before the Draft D ecision and the Draft SCCs 18 . 3 ANALYSIS OF THE DRAF T DECISION 3.1 References to the EUDPR (Recital (8))

The EDPB and the EDPS take note that Recital (8) of the Draft Decision reads as follows: “The standard contractual clauses may also be used for the transfer of personal data to a sub - processor in a third country by a processor that is not a Union institution or body, processing personal data on behalf of such an Union institution or body in accordance with Article 29 of Regulation (EU) 2018/1725 of the European Parliament and of th e Council. Doing so will also ensure compliance with Article 29(4) of Regulation (EU) 2018/1725, to the extent these clauses and the data protection obligations as set out in the contract or other legal act between the controller and the processor pursuant to Article 29(3) Regulation (EU) 2018/1725 are aligned. This will in particular be the case where the controller and processor rely on the standard contractual clauses included in Decision [….]”.

The EDPB and the EDPS understand that the intention of the Commission is that the Draft SCCs should cover processing operations between processors and sub - processors for which the controller is an EU institution, body, office or agency (“ EUI ”) subject to the EUDPR.

In this respect, the EDPB and the EDPS consider t hat the relevant requirements of the EUDPR should be reflected throughout the entire chain of contract s when a EUI is the controller. This should be further clarified in the Draft Decision and Draft SCCs.

In any event , the EDPB and the EDPS recall that it remains always possible for the Commission to remove any reference to the EUDPR if it decides not to apply the draft Article 46 SCCs to relations between processors and sub - processors being part of a processing operation for which the controller is a EUI subject to the EUDPR. 3.2 The scope of the Draft Decision and the notion of transfers (Article 1(1))

First, Article 1(1) of the Draft Decision provides that: “The standard contractual clauses set out in the Annex are considered to provide appropriate safeguar ds within the meaning of Article 46(1) and (2)(c) of Regulation (EU) 2016/679 for the transfer of personal data from a controller or processor subject to Regulation (EU) 2016/679 (data exporter) to a controller or (sub - ) processor not subject to Regulation (EU) 2016/679 (data importer).” 18 https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasu restransfe rstools_en.pdf . This document was submitted for public c onsultation until 21 December 2020 and is still subject to possible further modifications on the basis of the results of the public consultation. Adopted 9

In view of the above and of the title the D raft D ecision , the EDPB and the EDPS understand that the Draft Decision does not cover:  T ransfers to a data importer not in the EEA but subject to the GDPR for a given processing under Article 3 ( 2 ) GDPR; and  T ransfers to international organisations.

Second, the EDPB already clarified in its Guidelines on the territorial scope of the GDPR 19 that a controller or processor is never subject as such to the GDPR , but only in relation to a given processing activity.

Therefore, the EDPB and the EDPS recommend rephrasing Article 1(1) of the Draft Decision accordingly. 4 ANALYSIS OF THE DRAF T SCC s 4.1 General remark on the Draft SCCs

In relation to the reference to standard contractual clauses pursuant to Article 28(7) GDPR included in Clause 1(c) , the EDP B and the EDP S consider that it is important to clearly explain in the Draft Decision , the articulation and interplay between this set of SCCs and the SCCs pursuant to Article 28(7) GDPR. It should be made clear to the parties, already in the Draft D ecision, that when parties intend to benefit from SCCs both under Article 28 (7) and Article 46(2) ( c ) GDPR, then the parties need to rely on transfer SCCs. According to Clause 1(c) of the Draft SCCs, the parties are allowed to add other clauses or additional safeguards “ provided that they do not contradict, directly or indirectly,” the Draft SCCs . To provide controllers and processors with legal certainty, the EDPB and the EDPS would welcome clarifications on the type of clauses that the European Commission would consider as contradicting directly or indirectly the Draft SCCs. Such clarification c ould , for instance , indicate that clauses contradicting the Draft SCCs would be those that undermine / negatively impact the obligations in the Draft SCCs or prevent compliance with the obligations contained in the Draft SCCs. For example, 19 https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_ consultation_en_1.pdf . Adopted 10 clauses allowing processors to use the data for their own purposes would be contrary to the obligation of the processor to process personal data only on behalf of the controller and for the purposes and by the means identified by the latter. 4.2.2 Clause 2 - Th ird party beneficiaries

Pursuant to Section, I Clause 2, “ Data subjects may invoke and enforce these Clauses, as third party beneficiaries”. However, this right solely applies to the provisions that are not listed under this Clause 2 . For the sake of provi ding clear and unambiguous information to data subjects on their rights, as well as to controllers and processors that will use the Clauses on those third party beneficiary rights, the EDP B and the EDP S invite the European Commission to provide, under this Clause 2, a ‘positive’ list of the rights that are enforceable by data subjects, instead of listing those that are not enforceable 20 .

The EDP B and the EDP S are of the view that, as this is currently the case in the previous sets of SCCs ad opted by the European Commission 21 , and as it is required by SAs for binding corporate rules (“ BCRs ”), Section I Clause 2 ( T hird party beneficiaries) itself should be subject to enforceability by data subjects.

Under Section II, Module Two: Clause 1.9(a) and Module Three: Clause 1.9(a) contain the same requirements. They cover the data importer’s obligation to deal with the data exporter’s in quiries (as well as the controller’s inquiries, for Module Three). If breached, the EDP B and the EDP S are of the view that these two Clauses may have an impact on data subjects and their rights , hence should be deemed enforceable by data subjects, as this is currently the case in the previous sets of SCCs adopted by the European Commission 22 .

Under Section II, Module Three: Clause 1.1(a) relates to the data exporter’s obligation to inform the data importer that it acts under the controller’s instructions; C lause 1.1(b) sets out the data importer’s obligation to process the personal data under the controller’s instructions and those transmitted by the data exporter; and Clause 1.1(c) relates to the data importer’s obligation to inform the data exporter when t he data importer is unable to follow those instru ctions and the data exporter’s obligation to notify it to the controller. The EDP B and the EDPS note that a breach of Section II, Module Three: Clause 1.1(a), (b), and (c) may have an impact on data subjects and their rights , hence should 20 This would be better aligned with the way Chapter III GDPR is drafted, as well as with the previous sets of SCCs adopted by the European Commission (see Clause 3 2001 SCCs; Clause III(b) 2004 SCCs; and Clause 3.1 2010 SCCs). 21 See Clause 3 in 2001 SCCs; Clause III(b) in 2004 SCCs; Clause 3 in 2010 SCCs. 22 See Clause 5(e) in 2010 SCCs. Adopted 11 be made enforceable by them, as this is currently the case in the previous sets of SCCs adopted by the European Commission 23 .

Under Section II, Module Four: Clause 1.1 , the EDP B and the EDP S note that Clause 1.1(a) and (b) r elate to the data exporter’s obligation, respectively to process the data under the data importer’s instructions and to inform the data importer if the data exporter is unable to comply with the controller’s instructions or if they infringe Union or Member State’s data protection law; and Clause 1.1(c) covers the data importer’s obligation to refrain from taking any action preventing the data exporter from fulfilling its obligations under GDPR. Section II, Module Four: Clause 1.3 touches upon the parties’ a bility to demonstrate compliance with their commitments taken under the SCCs .

Since these provisions touch upon situations where the data importer cannot comply with the SCCs and/or is in breach of the SCCs , the EDP B and the EDP S are of the view that a violation of Section III, Clause 1(a), (b), (c), and (d) may have an impact on da ta subjects and their rights , and should therefore 23 This comment only applies for Section II Module Three: Clause 1.1(b) (see Clause 5(a) in 2010 SCCs) and Clause 1.1(c) (see Clause 5(b) in 2010 SCCs) of the Draft SCCs. There is no equivalent of Section II Module Three: Clause 1.1(a) in the previous SCCs. 24 See Clause 5(h)(i) and (j) in 2010 SCCs. 25 See Clause 5(c) in 2001 SCCs; Clause II(e) in 2004 SCCs; Clause 8.2 in 2010 SCCS. 26 See Article 47(2)(l) GDPR. See also Section 3.1 of the Working Document setti ng up a table with the elements and principles to be found in BCRs (WP256 rev.01), adopted by the Article 29 Working Party and endorsed by the EDPB, http://ec.europa.eu/newsroom/article29/item - detail.cfm?item_id=614109 ; and Section 3.1 of the Working Document setting up a table with the elements and principles to be found in Processor BCRs (WP257 rev.01), adopted by the Article 29 Working Party and end orsed by the EDPB, http://ec.europa.eu/newsroom/article29/item - detail.cfm?item_id=614110 . Adopted 12 be able to enforce them, as this is currently the case in the previous sets of SCCs adopted by the European Commission 27 , as well as in BCRs 28 . 4.2.3 Clause 6 - Docking clause

The EDP B and the EDP S welcome the inclusion of a docking clause in Clause 6 , which allows, as an option, any entity to accede to the Draft SCCs and therefore to become a new party to the contract as a controller or as a processor. T he qualification and the role of the parties to the contract should appear clearly in the Annexes, especially in the case where new parties accede to the contract. Thus, the Annex should detail and delimit the allocation of responsibilities , and indicate clearly which processing is carried out by whi ch processor(s) on behalf of which controller(s) , and for which purposes .

Clause 6(a) makes the accession of new parties to the Draft SCCs conditional upon the agreement of all the other parties. In order to avoid any difficulties in practice, the EDPB a nd the EDPS would welcome a clarification on the way such agreement could be given by the other parties (e.g. whether it has to be provided in writing, the deadline, the information needed before agreeing). Moreover, the EDPB and the EDPS would welcome cla rification as to whether and how such agreement has to be given by all the parties, irrespective of their qualification and role in the processing. 4.3 Section II - Obligations of the parties 4.3.1 Clause 1 - Data protection safeguards – Module One ( Transfer controller to controller ) 4.3.1.1 Scope of Module One (Transfer controller to controller )

This module seems to cover transfers between controllers acting as independent or separate controllers. In order to avoid any ambiguity, the EDPB and the EDPS call on the Co mmission to assess and clarify, in the Draft Decision or in the Draft SCCs, if th is module is only relevant for independent or separate controllers , or if it could also be used in joint controllership scenarios with regard to processing of personal data ca rried out by joint - controllers where one of the joint controller is established outside of the EU and not subject the GDPR. 4.3.1.2 Clause 1.2 - Transparency

Clause 1.2 ( a) of the Draft SCCs lists the elements on which the data importer must provide information to data subjects whose personal data are transferred. To ensure full transparency and put data subjects in a position to exercise their rights as provid ed by this c lause, the EDPB and the EDPS consider that the list of elements should further be completed , so as to be brought in line with A rticle 14 ( 1 ) and ( 2 ) GDPR relating to indirect collection of data. As such, th is clause should be complemented with information on the types of p ersonal data processed by the data importer, and the period for which personal data will be stored by the latter (or criteria used to determine it).

In addition, this clause should specify the timing in which the data importer shall provide this informatio n to data subjects so as to meet the conditions set out by A rticle 14( 3 ) GDPR. 27 See Clause 5(a) in 2001 SCCs; Clause II(c) in 2004 SCCs; Clauses 5(a) and (b), and Clause 12.1 in 2010 SCCs. 28 See Section 6.3 of the Working Document setting up a table with the elements and principles to be found in BCRs (WP256 rev.01); and Section 6.3 of the Working Document setting up a table with the elements and principles to be found in Processor BCRs (WP257 rev.01). Adopted 13

Furtherm ore, it results from Clause 1.2( b ) that the data importer may be exempted from providing information to da ta subjects in accordance with C lause 1.2 ( a ) , notably where providing such information proves impossible or would involve a disproportionate effort in which case the data importer shall, to the extent possible, make the i nformation publicly available. The use of the term “ to the extent possible ” does not appe ar in line with A rticle 14 ( 5 )( b ) GDPR and should be deleted. Indeed, A rticle 14( 5 )( b ) GDPR does not provide for such condition but rather sets a clear requirement that information is made publicly available to the data subject where providing such information proves impossible or would involve a disproportionate without any possible derogation. 4.3.1.3 Clause 1.5 - Security of processing

In connection with the data importer’s obligation to implement appropriate measures to ensure the security of transferred data, C lause 1.5 (a) specifies that the parties shall consider “ encryption during transmission a nd anonymisation or pseudonymisation, where this does not prevent fulfilling the purpose of processing”. In relation to the reference to anonymization, the EDPB and the EDPS recall that if personal data are anonymized , the obligations under the GDPR are no longer applicable. 4.3.1.4 Clause 1.7 - Onward transfers

First of all, the EDPB and the EDPS note that th is clause does not include a commitment from the data importer to notify the data exporter of the existence of an onward transfer as is the case in the 2004 SCCs for transfers from controllers to controllers. The EDPB and the EDPS do not see the reason for n ot replicating th is obligation in the proposed D raft SCCs. Such information of the data exporter is essential to allow the latter to comply with its obligations under A rticle 44 GDPR , which specifically refer to onward transfers and ensure accountability , as required by the GDPR , for any processing in this specific case for the processing subject to the onward transfer.

Further, C lause 1.7 provides that the data importer may carry out an onward transfer if the third party is or a grees to be bound by the Dr aft SCCs. It is unclear however, how this provision would work in practice if the third party concerned is a processor , notably how it would be bound by the clauses, which requirements will apply to it , and whether the parties could add another module (i.e . M odule T wo) that would b e relevant for that situation. This point requires clarification in the Draft SCCs to avoid any confusion in practice , and ensure legal certainty for the parties. In addition, it should be made clear that the third party should assess whether it is able to comply with the obligations set out by the Draft SCCs under the third country law applicable to this third party and , where necessary , to implement supplementary measures to ensure a level of protection essential ly equivalent t o the one required in the EEA .

Furthermore, an obligation should be added for the data importer to provide data subjects with a copy of the safeguards implemen ted for the onward transfer, upon request. The provision of a copy of such safeguards to data subject s contributes to the transparency which is required in relation to the transfer of their data.

Finally, C lause 1.7 (iv) sets out that an onward transfer cou ld be carried out where the data importer has obtained the explicit consent of the data subject. The possibility of relying on the data subject’s consent corresponds to the derogation for specific situations envisaged by A rticle 49 ( 1 )( a ) GDPR. The EDPB and the EDPS are of the opinion that the derogatory and exceptional nature of this possibility needs to be stated in the Draft SCCs , in particular compared to other possibilities for framing onward transfers re ferred in this clause. As such, it must be specified that the consent of the data subject could , as an exception, frame the onward transfers only if other mechanisms listed in C lause 1.7 cannot be relied upon . Also, the EDPB and the EDPS are of the opinion that the Commission should assess the poss ibility of onward transfers in particular for the establishment, exercise or defence of legal claims , and to protect the vital interests of the data subject or of other persons. 4.3.2 Clause 1 - Data protection safeguards – Module Two ( Transfer controller to processor ) 4.3.2.1 Clause 1.5 - Storage limitation and erasure or return of the data

Clause 1.5 of the Draft SCCs stipulates that upon termination of the provision of the processing services, the data importer shall delete all personal data processed on behalf of the data exporter (option 1) or return to the data exporter all personal data processed on its behalf , and delete existing copies (option 2). The EDPB and the EDPS are of the opinion that this wording conflicts with Art icle 28(3)(g) GDPR, which provides for that deletion or returning take s place “ at the choice of the controller ”. Accordingly, Clause 1.5 should provide for that deletion or returning of personal data to take place at the choice of the data exporter acting as a controller to avoid any ambiguity that such choice is not up to the data importer acting as a processor.

Moreover , Clause 1.5 sets forth that the data importer’s obligation to return or delete the personal d ata is notwithstanding any requirements “ under local law ” which prohibits return or destruction. This wording amounts to contradicting Article 28(3)(g) GDPR. The Commission should clarify in the Draft SCCs that only the requirements of local laws that resp ect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) GDPR should be taken into account under this c lause. The EDPB and the EDPS consider that specific legal requirements in terms of data rete ntion periods under local laws , types of data, and retention periods should be explicitly specified under Annex I.B. 4.3.2.2 Clause 1.6 - Security of processing

Similarly as in M odule O ne, C lause 1.6( a ) specifies that in order to ensure the security of data as part of the transfer , the parties shall consider “ encryption during transmission and anonymisation or pseudonymisation , where this does not prevent fulfilling the purpose of processing”. In relation to the reference to anonymization, the EDPB and the EDPS recall that if personal data is anonymized , the obligations under the GDPR are no longer applicable. Adopted 15

Clause 1.8 (i) should be completed with an obligation for the data importer to provide the data exporter , upon request, with a copy of the safeguards implemented for framing onward transfers to a third party. Such obligation was included in the controller to processor 2010 SCCs. T he EDPB and the EDPS do not see the reason for its exclusion from the proposed D raft SCCs , as the provision of these safeguards constitute an important element for the data exporter’s obligation under GDPR to ensure accountability with respect to the trans fers it carries out , including onward transfers.

An obligation should also be added for the data importer to provide data subjects with a copy of these safeguards upon request , as is the case in the controller to processor 2010 SCCs. As above, the EDPB an d the EDPS do not see the reason for excluding such obligation from the proposed D raft SCCs. The provision of these safeguards to the data subject contribute to the transparency which is required in relation to the transfer of their data. 4.3.2.4 Clause 1.9 - Docu mentation and compliance

Clause 1.9(d) of the Draft SCCs provides for the possibility for the data exporter, in order to conduct audits, to rely on an independent auditor mandated by the data importer. This provision is not foreseen in Art icle 28 (3)(h) GDPR , and needs to be aligned with this article which provides that the processor has to allow for and contribute to audits, including inspections, that are conducted by the controller or another auditor mandated by the controller 29 . As such, the processor might propose an auditor, but the decision about the auditor has to be left to the controller according to Art icle 28 (3)(h) GDPR. The controller’s right to choose the auditor should not be limited from the outset . Clause 1.9 (d) also states that where the data exporter mandates an independent auditor, it shall bear the costs, and where the data importer mandates an audit, it has to bear the costs of the independent auditor. As the issue of allocation of costs between a controller and a processor is not regu lated by the GDPR , consequently , the EDPB and the EDPS are of the opinion that any reference to the costs should be deleted from this clause. The same comment applies to the cor responding provision in Module Three . 29 As this is currently required by the EDPB in the context of BCRs for processors, see WP257 (endorsed by the EDPB), Section 2.3 “ A ny processor or sub - processor processing the personal data on behalf of a particular controller will accept, at the request of that controller, to submit their data processing facilities for audit of the processing activities relating to that controller wh ich shall be carried out by the controller or an inspection body composed of independent members and in possession of the required professional qualifications, bound by a duty of confidentiality, selected by the data controller, where applicable, in agreem ent with the Supervisory Authority.”; https://ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=49726 https://ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=49726 . Adopted 16 4.3.3 Clause 1 - Data protection safeguards – M odule Three ( Transfer processor to processor )

Pursuant to C lause 1.1 , the data importer is obliged to process the personal data only based on the controller’s instructions. In addition to that, Art icle 28(4) GDPR requires that , where a processor engages another (sub - )processor for carrying out specific processing activities on behalf of the controller, “ the same data protection obligations as set out in the contract or other legal act between the controller and the processor” as referred to in Art icle 28(3) GDPR shall be imposed on that other processor by way of a contract or other legal act under Union or Member State law. The EDPB and the EDPS are of the opinion that the requirement of Article 28(4) GDPR needs to be taken into account by the parties also in this scenario . 4.3.3.1 Clause 1.1 - Instructions

Module Three deals with processor to processor transfers. Accordingly, practitioners might initially assume that the contract pursuant to Art icle 46 GDPR may exclusively be concluded between the processor and its (sub - )processor if only Module Three is relied upon. However, C lause 1.1(a) refers to Annex I.A. and the list of “ parties ” which includes the identity and contact details of the controller and its signature. The EDPB and the EDPS are of the opinion that the Commission needs to clarify whether the controller has to sign these clauses , or whether the processor and sub - processor only need to mention the identity of the controller in the Annex. In the first case, it should be clarified to what effect and which obligations of Module Three would apply to the controller.

Furthermore, C lause 1.1 stipulates that the data exporter may give further instructions regarding the data processing “ within the framework of the contract agreed with the data importer throughout the duration of the contract ”. It is not clear whether the reference to the framework of the contract limits in any way the controller’s right to give further instructions regarding the da ta processing , all the more since C lause 7 of the draft Art icle 28 SCC s does not contain such possible limitation. Clause 7 states simply that “ Subsequent instructions may also be given by the data controller throughout the duration of the processing of personal data ”. 4.3.3.2 Clause 1.5 - Storage limitation and erasure or return of data

Clause 1.5 stipulates that upon termination of the provision of the processing services, the data importer shall delete all personal data processed on behalf of the controller (o ption 1) or return to the data exporter all personal data processed on its behalf and delete existing copies (option 2). The EDPB and the EDPS are of the opinion that this wording conflicts with Art icle 28(3)(g) GDPR, which provides for that deletion or re turning take s place “ at the choice of the controller ”. Accordingly, Clause 1.5 should provide for that deletion or returning of personal data to take place at the choice of the controller. Furthermore, it should be added to option 2 that the data importer should be required to certify to the data exporter that it has deleted existing copies.

Apart from that, Clause 1.5 sets forth that the data importer’s obligation to return or delete the personal data is notwithstanding any requirements “ under local law ” which prohibits return or destruction. This wording amounts to contradicting Article 28(3)(g) GDPR. Taking into account that the processor is subject to third country laws , and therefore may be subject to a legal obligation to (further) storage of the data (e.g. for accounting purposes), the EDPB and the EDPS consider that the Commission should clarify in the Draft SCCs that only the requirements of local laws that respect the essence of the fundamental rights and freedoms and do not exceed what is necessar y and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) GDPR should be taken into account under this Clause. As in Module Two, the EDPB and the EDPS consider Adopted 17 that specific legal requirements in terms of data rete ntion periods under local laws , types of data, and retention periods should be explicitly specified under Annex I.B. Furthermore, the term “ to the extent possible ” should be deleted. To avoid repetition, the EDPB and the EDPS invite the Commission to r efer to Section 4.3.2.1. 4.3.3.3 Clause 1.5 - Security of processing and Clause 1.6 - Special categories of personal data

For the avoidance of repetition, the EDPB and the EDPS invite the Commission to refer to their comments made under Section 4.3.2.2. 4.3.4 Clause 1 - Data protection safeguards – Module Four ( Transfer processor to controller )

The EDPB and the EDPS recognise that the scope of Module Four includ es only transfers from a processor subject to GDPR to its own controller not subject to GDPR , and exclud es transfers from such a processor to any other controller, as is clarified in Article 1.1 and R ecital 16 of the Draft D ecision. Nevertheless , to avoid any misunderstanding about the scope of this module , the EDPB and the EDPS would recommend a short explana tion of the limited scope of Module F our in the Draft SCC themselves.

To provide for all the necessary provisions of Art icle 28 GDPR directly applicable to the processor, Module Four should be completed as follows :

There should be a commitment from the processor that persons authori s ed to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality ( Article 28 ( 3 )( b ) GDPR).

A clause on the personal data breach notifications obligations imposed on the pr ocessor by virtue of Article 33( 2 ) GDPR should also be added to this M odule of the SCCs.

Furthermore the M odule should be completed with a clause on sub - processing by the processor/ data exporter as t his is a direct obligation for the processor under A rticle 28 ( 3 ) and ( 4 ) GDPR .

Moreover, the parties must commit themselves to mutual assistance and support. In addition to the obligation already set out in Clause 5 of Module F our, this also concerns the obligation of the processor to inform the controller of personal data breaches (Art icle 33( 2 ) GDPR), which should be explicitly included in the agreement. 4.3.5 Horizontal remarks - Clause 2 (Local laws affecting compliance with the Clauses) and Clause 3 (Obligations of the data importer in case of government access requests) 4.3.5.1 Partial exemption of application to Module Four

Concerning the fact that C lauses 2 and 3 will apply to M odule Four “ only if the EU processor combines the personal data received from the third country - controller with personal data collected by the processor in the EU ” , the EDPB and the EDPS stress that Art icle 3( 1 ) GDPR does not state that personal data processed by the processor in the EU shall (also) be collected in the EU for the processor obligations to be applied to them. Therefore, the EDPB and the EDPS call on the Commission to clarify the reasons why this exemption has been inserted , and to further assess whether this exemption is justified. Adopted 18

Moreover, the EDPB and the EDPS call on the Commission to clarify the notion of “ combination ” of the personal data received from the third country controller with personal data collected by the processor in the EU , and the situations where this combination will take place , as such notion of combination of data is not envisaged in the GDPR. 4.3.5.2 Situations covered by Clauses 2 and 3

In particular, C lause 2(a) does not seem to impose any specific obligation in the case where there is no law relating to public authorities’ access to personal data. In this respect, it is recalled that the EDPB Recommendations on supplementar y measures provide that , in the absence of publicly available legislation, the data exporter should still look into other relevant and objective factors. The rationale behind this recommendation is that it cannot be reasonably inferred from the absence of law on public authorities’ access to personal data that no access takes place in practice.

Therefore, the EDPB and the EDPS recommend to complement C lauses 2 and 3 to provide safeguards also in situations where the third country does not have a legislatio n, but where such practices, which would then be contrary to EU data protection requirements, exist or where the practice will diverge from the provisions of the legal framework. In particular, it should thus be clarified in the Draft SCCs that , in the absence of laws in the third country relating to public authorities’ access to personal data, the parties should nevertheless, based on any available information, strive to identify any practice applicable to the data transferred preventing the dat a importer from fulfilling its obligations. 4.3.5.3 Scope of Clauses 2 And 3

Also concerning the scope of the clauses, the EDPB and the EDPS note that some elements such as the reference to the “ absence of requests for disclosure from public authorities receiv ed b y the data importer ” or to “ relevant practical experience ” in this regard in C lause 2(b), as well as t he use of the present tense in C lause 2(e) concerning the moment in which the data importer “ is or has become subject to laws not in line with the requi rements under paragraph a) ” of C lause 2, are source of ambiguity. Indeed, these elements may give the impression that even when the prior assessment of the legal framework of the third country of the importer led to the conclusion that the legislation of t he third country is not compliant with the EU requirements in terms of level of protection afforded to personal data and that no effective supplementary measure(s) could be put in place, transfers could still take place. The EDPB and the EDPS therefore rec ommend to clarify that these clauses will apply only to situations where , at the time of the conclusion of the contract, either the relevant law (s) of the third country was (were) assessed to be providing an essentially equivalent level of protection to th at guaranteed within the EU, or where effective supplementary measures to remedy the potential deficiencies identified in such legislation and/or practices and to ensure the effective application of the safeguards contained in the Draft SCCs have been put in place so as to allow the data importer to comply with its obligations , or where the third country does not have any law in the field relevant to the transferred data. Adopted 19

The EDPB and the EDPS stress that the assessment of whether there is anything in the law or practice of the third country of destination, which prevents the data importe r from fulfilling its obligations under the Draft SCCs in the context of the specific transfer, should be based on objective factors, regardless of the likelihood of access to the personal data. As underlined in the EDPB R ecommendations on supplementary me asure s (in particular paragraphs 33 and 42 30 , this assessment depends on the circumstances of the transfer and in particular on the following objective factors:  Purposes for which the data are transferred and processed (e.g. marketing, HR, storage, IT support, clinical trials);  Types of entities involved in the processing (public/private; controller/processor);  Sector in which the transfer occurs (e.g. adtech, telecommunication, financial, etc . );  Categories of personal data transferred (e.g. personal da ta relating to children may fall within the scope of specific legislation in the third country);  Whether the data will be stored in the third country or whether there is only remote access to data stored within the EU/EEA;  Format of the data to be transfer red (i.e. in plain text/ pseudonymised or encrypted);  Possibility that the data may be subject to onward transfers from the third country to another third country.

In this respect, the EDPB and the EDPS also recall that in the Schrems II ruling , the CJEU did not refer to any subjective factor such as the likelihood of access , for instance. The mere fact that the data are comprised within the scope of a third country legislation that allows access to data by public authorities without specific essential gu arantees (as recalled in the EDPB R ecommendations 02/2020 on the European E ssential G uarantees for surveillance measures 31 ) would amount , per se , to considering that such access will possibly take place, without the need to rely on any practical 30 https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymea surestransferstools_en.pdf . 31 https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_recommendations_202002_europeanessentialguar anteessurveillance_en.pdf . Adopted 20 experience in this regard or absence of requests for disclosure from public authorities received by the data importer. The current drafting of C lause 2( b) ( i) can therefore be misunderstood as it might be read as permit ting data to be exported if the data i mporter has not yet received any order to disclose personal data, even if it is subject to local laws permitting such orders. It could also be understood to allow continu ing the transfer where the data importer is simply not permitted to inform the data ex porter in this respect due to a gag order. Furthermore, assessing these kinds of subjective factors (likelihood of access) in practice would prove to be very difficult and hardly verifiable.

In order to avoid that the parties merely agree to document the above - mentioned assessment without doing so in practice, the EDPB and the EDPS recommend to add an annex to the Draft SCCs to require the parties to document , prior to the signature of the cont ract , th is assessment led under C lause 2 ( i.e., the assessment of the third country’s legislation and practices in the light of the circumstances of the transfer). This would help to achieve that the Draft SCCs will be correctly used, as an explicit annex would po int the data importers and data exporters to the necessity of this assessment. 4.3.6.3 Consultation of the SA on supplementary measures

Under C lause 2(f), the Draft SCCs provide for the consultation of the competent supervisory authority (“ SA ”) . As underlined in the EDPB R ecommendations on supplementary measures, “ when you intend to put in place supplementary measures in addition to SCCs, there is no need for you to request an authorisation from the competent SA to add these kind of clauses or additional safeguard s as long as the identified supplementary measures do not contradict, directly or indirectly, the SCCs and are sufficient to ensure that the level of protection guaranteed by the GDPR is not undermined .” 32

Indeed, it is the responsibility of the data exporter , with the assistance of the data importer , to identify those measures. This is in line with the principle of accountability of Article 5( 2 ) GDPR, which requires controllers to be responsible for, and be able to demonstrate compliance with the GDPR principles relating to processing of personal data. This was emphasized by the CJEU in its Schrems II ruling 33 , and recalled in the EDPB R ecommendations on supplementary measures 34 . 32 https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymea surestransferstools_en.pdf ; para 56 33 Judgment of the Court (Grand Chamber) of 16 July 2020; Data Protec tion Commissioner v Facebook Ireland Limited and Maximillian Schrems; Case C - 311/18; para 134. 34 https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymea surestransferstools_en.pdf ; para 5 Adopted 21

The EDPB and the EDPS recall that in previous SCCs, the data exporter had to “ forward ” the notification made by the data importer relating to the impossibility to respect the SCCs to the SA , where it ” decides, notwithstanding that notification, to continue the transfer or to lift the suspension ” . This commitment, scrutinized by the CJEU in the Schrems II ruling, paragraph 145, should be retained in the Draft SCCs.

In line with the provisions contained in the 2010 SCCs 35 , as scrutinized by the CJEU , a notification should be foreseen only if the data exporter intends to continue the transfer in the absence of effective supplementary measures. This case is not reflected in the D raft SCCs yet, while it is indeed the situatio n where a SA could have a role to play , and could intervene with its powers to suspend or prohibit data transfers in those cases where it finds that an essentially equivalent level of protection cannot be ensured in accord ance with the Schrems II ruling 36 .

Under C lause 3.1, the EDPB and the EDPS underline that it should be clarified that the notification foreseen by the data importer would take place before having replied to the access request by third country’s public authorities , so as to allow the data exporter to take any appropriate further steps , if needed. 4.3.7.2 Clause 3.2 – Review of legality and data minimisation

The EDPB and the EDPS understand that the scope of C lause 3.2 is limited to situations where access requests received by the data importer will not be compliant with the legislation o f the third country, including its obligations resulting from international law and its rules governing conflicts of laws situations. The EDPB and the EDPS consequently recommen d clarifying this clause in order to ensure that data exporters do not misunder stand it. This clause is only meant to ensure that the legislation of the third country already complying with EU law requirements will be applied correctly in that third 35 2010/87/: Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to pro cessors established in third countries under Directive 95/46/EC of the European Parliament and of the Council; OJ L 39, 12.2.2010, p. 5 – 18; Annex - Clause 4(g). 36 Judgment of the Court (Grand Chamber) of 16 July 2020; Data Protection Commissioner v Faceboo k Ireland Limited and Maximillian Schrems; Case C - 311/18; para 113 and 121 . Adopted 22 country. Therefore, this clause will not , per se , result in challenging the legality of requests of disclosure against EU data protection requirements, unless the legislation of the third country expressly provides for the possibility to invoke the legislation of another country. 4.3.8 Clause 5 - Data subject rights - Module One (Transfer cont roller to controller)  Clause 5 (a)

Additionally, the EDP B and the EDP S are of the opinion that the obligation imposed on the data importer to provide informat ion to data subjects upon request should be clearly introduced in the Draft SCCs , and fully aligned with the requirements under Article 12(1) and Article 15 GDPR.  Clause 5 (b)

In the opinion of the EDP B and the EDP S , data subjects should have the right to access, upon request, to more information than those currently listed under Clause 5(b)(i), and more precisely to:  M ore precise information in relation to onward transfers, including for sub - processors, i.e., the full name and contact details of all recipi ents of the data relating to them 38 . This could be achieved by requiring the parties to provide such information in Annex III of the D raft SCCs , or by requiring to provide them to data subjects upon request;  I n accordance with Article 15(1)(d) GDPR, precise information on the envisaged period for which the personal data will be stored, where possible, or if not, the criteria used to determine that period. This could be achieved by requiring the parties to provide such information in Annex I of the Draft SCCs . Providing such information in Annex I might also make it clear to the parties that they need to actually define and implement retention periods; and  I n accordance with Article 15(1)(g) GDPR, any available information as to the source of collection , where the personal data are not collected directly from data subjects.

Module One should include the data importer’s obligation to inform data subjects on their rights to request rectification or erasure of their personal data, as well as their rights to request restriction of or to object to the processing of their personal data, which would bring this c lause in line with Article 15(1)(e) GDPR. Such information would come in addition to information on the right to lodge a complaint with the competent SA, as currently included under Clause 5(b)(i). More generally, the EDPB and the EDPS call on the Commission to insert the obligation for the data importer to allow data subjects to exercise their right to request the restriction of the processing of their data. 37 S ee clause 1(d) and Clause II(e) in 200 4 SCCs . 38 See Judgment of the Court (Third Chamber) of 7 May 2009; CJEU College van burgemeester en wethouders van Rotterdam v M.E.E. Rijkeboer C - 553/07; para 49 and 54 Adopted 23

As to Clause 5(b)(iii) concerning erasure of data subjects’ personal data, the EDP B and the EDP S are of the opinion that such commitment should completely reflect the requirements set out in Article 17(1) GDPR.  Clause 5(c )

The EDPB and the EDPS are of the opinion that it is not justified to limit the right to object to di rect marketing cases and that the scope of the right to object should be extended, especially in cases where the right to object is enforceable against the data exporter in the first place.  Clause 5(d )

The EDP B and the EDP S are of the opinion that the wording of Clause 5(d) should be revised so as to mirror Article 22 GDPR’s prohibition of automated decision - making as a principle, and should set out the conditions allowing derogations to such prohibition. Clause 5(d) should also clarify that the data importer’s obligations to implement suitable safeguards and provide information about the envisaged automated decision to data subjects are cumulative.

In addition, in accordance with Article 22 and Article 15(1)(h) GDPR, Clause 5(d) should require that information provided to data subjects include the significance and the envisaged consequences for data subjects.  Clause 5(f)

Whilst the EDP B and the EDP S acknowledge that there may be circumstances justifying that the data importer may refuse a data subject’s request, it should be made clear in the Draft SCCs that only the requirements of local laws that respect the essence of the fundamental rights and fr eedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) GDPR should be taken into account under this Clause.  Clause 5(g)

In order for data subjects to be fully able to exercise their rights, the EDPB and the EDPS consider that the obligation to inform data subject s that the data importer intends to reject their requests should be aligned with Article 12(4) GDPR, hence be provided without delay and at the latest within on e month of receipt of the request. 4.3.9 Clause 5 - Data subject rights - Modules Two (Transfer controller to processor) and Three (Transfer processor to processor)

The EDP B and the EDP S share the opinion that Clause 5(a) should:  F urther specify that the responses to data subjects shall be made in accordance with the controller’s instructions (e.g. on content of the response) as set out in annex to the Draft SCCs.  F urther specify that the scope of the data importer’s obligation rel ating to the exercise of data subject s ’ rights on behalf of the controller should be described and clearly set out in annex to the Draft SCCs. Adopted 24 4.3.10 Clause 5 - Data subject rights - Module Four (Transfer processor to controller)

The EDP B and the EDP S would welcome clarification in the Draft SCCs as to whether the option to offer data subjects the possibility to seek redress before an independent dispute resolution body, at no cost, has to be provided in all sets of clauses. While it would be clear that this option may help ensure effective enforcement in case of controller to controller transfer, the EDP B and the EDP S would welcome further clarification as to how this mechanism will apply in Modules Two , Three , and Four . For instan ce, it should be clarified to which extent this mechanism would apply in relation to the specific and direct obligations of the processor a nd of the controller in Module Four .

As for the clauses on redress envisaged in Modules One , Two , and Three (Clause 6(b)), the EDP B and the EDP S are of the opinion that it should be made clearer that the data importer shall accept the right of the data subject (who invokes his or her rights as a third party beneficiary) to lodge directly a complaint with an EEA SA and/or bring a claim before an EEA court without the need to seek an amicable resolution of the dispute in advance. In fact, in order to ensure the same level of protection envisaged by A rticles 77 and 79 GDPR, such type of mechanisms (e.g. internal compla int - handling mechanisms put in place by the data importer) should be encouraged so as to facilitate the exercise of the third party beneficiary rights , but they should not be considered as a prerequisite for lodging a complaint with the SA or with a court.

Furthermore, Article 77 ( 1 ) GDPR provides that data subject s shall be able to choose to lodge a claim before the SA of their habitual residence, place of work, or place of the alleged infringement. From this perspective, the EDP B and the EDP S consider it t o be important to amend C lause 6(b)(i) accordingly – as the D raft SCCs seem to refer only to the SA with responsibility for ensuring compliance by the data exporter with the GDPR as regards the data transfer.

The EDP B and the EDP S call for clarifications i n relation to the absence of a redress clause in Module Four . Taking into consideration the commitmen ts currently contained in Clause 5 of Module Four in relation to ‘data processing by the data exporter in the EU, under the GDPR’, the EDPB and the EDPS are wondering how the data subject’s right to redress will be recognised in such cases. 4.3.12 Clause 7 - Liability - Module s One (Transfer controller to controller) and Four (Transfer processor to controller)

In Clause 7, Module s One and Four, the EDP B and the EDP S note that the joint and several liability towards the data subject would only be triggered in case there is a shared responsibility. In other words, the liability regime envisaged in the Draft SCCs does not provide for a full joint and several li ability where each party would be responsible for the damage solely caused by the other party.

In this context, the EDP B and the EDP S would like to recall that the Draft SCCs should incorporate effective mechanisms that make it possible, in practice, to e nsure compliance with the level of Adopted 25 protection required by EU law 39 . However, bringing an action against a non - EU company may prove to be difficult for the data subject as regards enforcement of the judgment against that non - EU company. The existing sets of SCCs are more protective than what is proposed in the Draft SCCs, and the EDPB and the EDPS are of the opinion that the protection of data subjects should be reinforced in this regard.

Against this background, the EDP B and the EDP S call for an amendment of Clause 7 in line with the considerations made above. 4.3.13 Clause 7 - Liability - Module s Two (Transfer controller to processor) and Three (Transfer processor to processor)

In Module s Two and Three, Clause 7(c) and 7(d) , it is envisaged that the data subject shall be entitled to receive compensation , for any material or non - material damages the data importer caused , against the data importer (c) or against the data exporter (d).

For the avoidance of doubt, it should be clarified in the Draft SCCs by the Commission that these possibilities are cumulative and the data subject has a choice to receive compensation, for any material or non - material damages the data importer caused, either against the data importer or the data exporter. In other words, the possibility to seek the liability of the data exporter for any material or non - material damages caused by the data importer should not be conditioned by an action against the data importer. 4.3.14 Clause 9 - Supervision

Clause 1(d) provides for an exception to the obligation to return or destroy the data prior to the termination of the contract when the local law applicable to the data importer prohibits this return or destruction. The EDP B and the EDP S call the Commission to recall that the obligations of the data importer under Clause 5 Section II would also apply in the case referred to in Clause 1(d) Section III. The EDPB and the EDPS consider that the Commission should clarify in the Draft SCCs that only the requirements of local laws that respect the essence of the fundamental rights and freedoms and do not exceed what is necessary and proportionate in a democratic society to safeguard one of the objectives listed in Article 23(1) GDPR should be take n into account under this c lause. 39 For instance, A rticle 47(2)(f) GDPR requires that BCRs shall specify, amongst others, “ the acceptance by the controller or processor established on the territory of a Member State of liability for any breaches of the binding corporate rules by any member concerned not es tablished in the Union ”. Adopted 26

The EDP B and the EDP S note th at the Draft SCCs are designed to be possibly used – as a Multi Party Agreement - by more than one party as data exporters and/or as data importers. In order to avoid the risk of blurring roles and responsibilities , it is important to provide the parties, in the Draft SCC s , with clear indications as to how the Annex should to be filled ou t appropriately. This is all the more necessary because of the mo dular approach that allows the c lauses to be incorporated within o ne Multi Party Agreement covering up to four scenarios ( controller - to - controller, controller - to - processor, processor - to - processor, and processor - to - controller tra nsfers) , and possibly a large number of transfers, each of them possibly occurring between dif ferent data exporters and/or data importers. The EDP B and the EDP S are therefore of the opinion that it is of utmost importance that the contract that will be signed in practice, including its Annexes, will, with absolute clarity , delimit the roles and res ponsibilities of each of the parties ( data exporter - controller, data exporter - processor, data importer - controller, data importer - processor ) in each relationship , and with regard to each transfer or set of transfers covered.

For these reasons , the Annex to the contract should be precise enough so it is possible at any point in time to determine who takes which role as regards a specific transfer or set of transfers of personal data. The EDP B and the EDP S therefore suggest to clarify that each transfer or set of transfers , i. e. each transfer or set of transfers carried out for one or several certain and defined purposes, should be separately described on the basis of its/their purpose(s), the types of personal data transferred, the category or categories of d ata subjects, the type(s) of processing, and the parties to the transfer (data importer ( s ) and data exporter ( s ) ) , as well as the role of the respective parties (controller ( s ) or processor ( s) ) . Consequently, as a rule, a distinct Annex – which should include Parts I to VI - per transfer or set of transfers , will always be required. Such distinct Annex required for each transfer or set of transfers should be signed only by those data exporters and data importers which carry out the respective transfer. At the same time , each data exporter and data importer signing the respective Annex should specify, when signing the Annex relating to the respective transfer or the respective set of transfers, its role a s regards this transfer or set of transfers (contro ller or processor) , in order to avoid any ambiguities.

As a result, in case of a Multi Party Agreement addressing several transfers and/or parties, it should always be clear which Annex (comprising Parts I to VI) applies to which specific transfer or set of transfer, who the data exporters and data importers involved in that transfer or set of transfers are, and which role (controller or processor) the respective data exporter or data importer takes in that transfer or set of transfers. To this aim , the ED P B and the EDP S suggest to include some explanatory wording, in the “Annex” part of the Draft SCCs, aimed at guiding the parties on the appropriate use and signing of the Annex, in particular in the case of the Draft SCCs being used as a Multi Party Agreem ent. The EDP B and the EDP S have provided some corresponding wording suggestions in the technical annex of this Joint Opinion.

Another problem encountered in practice , is that SCCs Annexes on technical and organi s ational measures are often filled out in a very generic way because they are meant to be made fit for a whole variety of different transfers and processing operations, while lacking precise indication as to which techn ical and organisational measures apply to which of the transfers covered by the SCCs. Therefore , the EDP B and the EDP S suggest to expressly highlight in the Draft SCC (Part III of the Annex as suggested by the EDP B and the EDP S ) that only those specific technical and organi s ational measures that will be applied to the respective transfer/set of transfers should be enumerated, while technical and organisational measures that will only apply to other transfers / categories of transfers covered by the same M ulti Party Agreement should only be filled out in those Annex that relates to those respective transfers for their part. 132. As regards controller - processor relationships, the EDP B and the EDP S note that , in practice , there is sometimes confusion about the re quirements relating to sub - processors. The requirements set out in the Draft SCCs to enlist each and every sub - processor should be specifically recalled and reflected in Part V of the Annex. Moreover, the EDP B and the EDP S would suggest to indicate (as Par t V of the Annex as suggested) the list of intended sub - processors (including, per each, their location, the processing operation(s), and type of safeguards they have implemented) in order to enable the controller to authorise the use of the intended sub - p rocessors as required by Article 28(2) GDPR. It would be, moreover, also useful to insert the sentence that the controller has authorised the use of the sub - processors mentioned in that list. For the European Data Protection Supervisor The European Data Protection Supervisor (Wojciech Wiewiorowski) For the European Data Protection Board The Chair (Andrea Jelinek)