On 04 June 2021, the European Commission has adopted a new set of standard contractual clauses for the transfer of personal data to third countries pursuant to the Regulation (EU) 2016/679 of the European Parliament and of the European Council – General Data Protection Regulation (hereinafter: “GDPR“).

The adoption of new standard contractual clauses was inevitable, taking into consideration the fact that the previous set of standard contractual clauses was adopted before the adoption of the GDPR in 2016 (Regulation (EU) 2016/679), during the application of the Data Protection Directive (Directive (EC) 95/46) and the fact that more than 25 years have passed since their adoption, during which an accelerated development of technology happened, followed by the improvement of the way personal data is being collected.

A novelty, which appears within the nature of the new standard contractual clauses, is the fact that they can be used completely or partly as a model contract on the processing of personal data or other legal act by which the subjects regulate their relationship.

The new standard contractual clauses also bring us a wider circle of subjects whose mutual relationship falls under their regulation. Namely, the old set of standard contractual clauses regulated only the relations between the controller and the controller located outside the territory of the EU/EC and the controller and processor located outside the territory of the EU/EC. Therefore, the new standard contractual clauses expand the circle of entities whose relations regulate the regulation of relations between processors and processors located outside the territory of the EU/EC (sub-processor) and processors and controllers located outside the territory of the EU/EC.

Taking into account that the new set of standard contractual clauses has been adopted, the fate of […]

Evropska komisija je 04.06.2021. godine usvojila novi set standardnih ugovornih klauzula za prenos ličnih podataka u treće zemlje, u skladu sa Uredbom (EU) 2016/679 Evropskog parlamenta i Evropskog saveta – Generalna regulativa za zaštitu podataka (u daljem tekstu: „GDPR“).

Donošenje novih standardnih ugovornih klauzula je bilo neminovno, uzimajući u obzir da je prethodni set standardnih ugovornih klauzula usvojen pre donošenja GDPR 2016. godine (Uredba (EU) 2016/679), u vreme važenja Opšte direktive o zaštiti podataka (Direktiva (EZ) 95/46) i samom činjenicom da je od njihovog donošenja proteklo više od 25 godina, tokom kojih je došlo do ubrzanog razvoja tehnologije, ali i unapređivanja načina prikupljanja ličnih podataka.

Novina koja se javlja u samoj prirodi novih standardnih ugovornih klauzula je činjenica da se one kao takve, mogu u celini ili delimično koristiti kao model ugovora o obradi podataka o ličnosti ili drugog pravnog akta kojim subjekti regulišu svoj odnos.

Nove standardne ugovorne klauzule donose nam i širi krug subjekata čiji međusobni odnos potpada pod njihovo regulisanje. Naime, stari set standardnih ugovornih klauzula regulisao je samo odnose između rukovaoca i rukovaoca koji se nalazi van teritorije EU/EZ i rukovaoca i obrađivača koji se nalazi van teritorije EU/EZ. Stoga, nove standardne ugovorne klauzule proširuju krug subjekata čije odnose regulišu na uređivanje odnosa između obrađivača i obrađivača koji se nalazi van teritorije EU/EZ (podobrađivač) i obrađivača i rukovaoca koji se nalazi van teritorije EU/EZ.

Uzimajući u obzir da je donet novi set standardnih ugovornih klauzula, sudbina starih je takva da će one važiti zaključno sa 27.09.2022. godine, do kad je potrebno da subjekti svoje odnose regulišu na nov način, tj. pređu na nove standardne ugovorne klauzule.