31
Recital 5 of Implementing Decision 2016/2297, adopted after the judgment of 6 October 2015,
Schrems (C‑362/14, EU:C:2015:650) was handed down, reads as follows:
‘Mutatis mutandis, a Commission decision adopted pursuant to Article 26(4) of Directive [95/46] is
binding on all organs of the Member States to which it is addressed, including their independent
supervisory authorities, in so far as it has the effect of recognising that transfers taking place on the
basis of standard contractual clauses set out therein offer sufficient safeguards as required by
Article 26(2) of that Directive. This does not prevent a national supervisory authority from exercising
its powers to oversee data flows, including the power to suspend or ban a transfer of personal data
when it determines that the transfer is carried out in violation of EU or national data protection law,
such as, for instance, when the data importer does not respect the standard contractual clauses.’
32
According to its current wording, resulting from Implementing Decision 2016/2297, Article 4 of the
SCC Decision states:
‘Whenever the competent authorities in Member States exercise their powers pursuant to Article 28(3)
of Directive [95/46] leading to the suspension or definitive ban of data flows to third countries in order
to protect individuals with regard to the processing of their personal data, the Member State concerned
shall, without delay, inform the Commission which will forward the information to the other Member
States.’
33
The annex to the SCC Decision, under the heading ‘Standard Contractual Clauses (Processors)’, is
comprised of 12 standard clauses. Clause 3 thereof, itself under the heading ‘Third-party beneficiary
clause’, provides:
‘1.
The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a)
to (e), and (g) to (j), Clause 6(1) and (2), Clause 7, Clause 8(2), and Clauses 9 to 12 as third-party
beneficiary.
2.
The data subject can enforce against the data importer this Clause, Clause 5(a) to (e) and (g),
Clause 6, Clause 7, Clause 8(2), and Clauses 9 to 12, in cases where the data exporter has factually
disappeared or has ceased to exist in law unless any successor entity has assumed the entire legal
obligations of the data exporter by contract or by operation of law, as a result of which it takes on the
rights and obligations of the data exporter, in which case the data subject can enforce them against such
entity.
…’
34
According to Clause 4 in that annex, under the heading ‘Obligations of the data exporter’:
‘The data exporter agrees and warrants:
(a)
that the processing, including the transfer itself, of the personal data has been and will continue
to be carried out in accordance with the relevant provisions of the applicable data protection law
(and, where applicable, has been notified to the relevant authorities of the Member State where
the data exporter is established) and does not violate the relevant provisions of that State;
(b)
that it has instructed and throughout the duration of the personal data-processing services will
instruct the data importer to process the personal data transferred only on the data exporter’s
behalf and in accordance with the applicable data protection law and the Clauses;
…
(f)
that, if the transfer involves special categories of data, the data subject has been informed or will
be informed before, or as soon as possible after, the transfer that its data could be transmitted to a
third country not providing adequate protection within the meaning of Directive [95/46];
(g)
to forward any notification received from the data importer or any sub-processor pursuant to
Clause 5(b) and Clause 8(3) to the data protection supervisory authority if the data exporter