27
Article 1 of the SCC Decision states:
‘The standard contractual clauses set out in the Annex are considered as offering adequate safeguards
with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as
regards the exercise of the corresponding rights as required by Article 26(2) of Directive [95/46].’
28
In accordance with the second paragraph of Article 2 of the SCC Decision, that decision ‘shall apply
to the transfer of personal data by controllers established in the European Union to recipients
established outside the territory of the European Union who act only as data processors’.
29
Article 3 of the SCC Decision provides:
‘For the purposes of this Decision, the following definitions shall apply:
…
(c)
“data exporter” means the controller who transfers the personal data;
(d)
“data importer” means the processor established in a third country who agrees to receive from
the data exporter personal data intended for processing on the data exporter’s behalf after the
transfer in accordance with his instructions and the terms of this Decision and who is not subject
to a third country’s system ensuring adequate protection within the meaning of Article 25(1) of
Directive [95/46];
…
(f)
“applicable data protection law” means the legislation protecting the fundamental rights and
freedoms of individuals and, in particular, their right to privacy with respect to the processing of
personal data applicable to a data controller in the Member State in which the data exporter is
established;
…’
30
According to its original wording, prior to the entry into force of Implementing Decision 2016/2297,
Article 4 of Decision 2010/87 provided:
‘1.
‘Without prejudice to their powers to take action to ensure compliance with national provisions
adopted pursuant to Chapters II, III, V and VI of Directive [95/46], the competent authorities in the
Member States may exercise their existing powers to prohibit or suspend data flows to third countries
in order to protect individuals with regard to the processing of their personal data in cases where:
(a)
it is established that the law to which the data importer or a sub-processor is subject imposes
upon him requirements to derogate from the applicable data protection law which go beyond the
restrictions necessary in a democratic society as provided for in Article 13 of Directive [95/46]
where those requirements are likely to have a substantial adverse effect on the guarantees
provided by the applicable data protection law and the standard contractual clauses;
(b)
a competent authority has established that the data importer or a sub-processor has not respected
the standard contractual clauses in the Annex; or
(c)
there is a substantial likelihood that the standard contractual clauses in the Annex are not being
or will not be complied with and the continuing transfer would create an imminent risk of grave
harm to the data subjects.
2.
The prohibition or suspension pursuant to paragraph 1 shall be lifted as soon as the reasons for
the suspension or prohibition no longer exist.
3.
When Member States adopt measures pursuant to paragraphs 1 and 2, they shall, without delay,
inform the Commission which will forward the information to the other Member States.’