OCLC's Standard Contractual Clause (SCC) updates: What you need to know

In July 2020, the Court of Justice of the European Union ("CJEU"), in a case known as "Schrems II", ruled on the mechanisms for data transfers under GDPR. The CJEU confirmed that the Standard Contractual Clauses (the "SCCs") issued by the European Commission for the transfer of personal data to data processors established outside of the EU is a valid transfer mechanism under GDPR. However, the CJEU stated that for the transfer to be legal, data subjects must be granted a level of protection in the receiving country essentially equivalent to that guaranteed within the EU.

The European Data Protection Board (EDPB) issued further guidance on the application of the Schrems II ruling to the use of SCCs. As OCLC and its affiliated entities use SCCs as the main mechanism for intercompany data transfers outside of the EU, we have updated our SCCs in order to follow the EDPB guidance.

Additionally, OCLC has entered into a document similar to the SCCs for data transfers to and from the United Kingdom, a Data Transfer Agreement. This document ensures that OCLC has a valid data transfer mechanism under UK GDPR, which is now in effect.

Finally, on June 4, 2021, the European Commission adopted a modernized set of SCCs that incorporates "Schrems II"-style protections and also allows for a more tailored approach depending on the parties involved. These New SCCs will replace the current SCCs. Agreements which incorporate the old SCCs can be executed/signed until September 27, 2021. As of September 28, 2021, all new agreements must use the new SCCs. However, existing agreements that rely on the old SCCs (executed until 27th of September 2021) do not need to be updated until December 2022.

Therefore, for existing agreements, OCLC will continue relying on the existing SCCs, and during the year 2022 it will gradually update all its agreements with existing customers to replace the old SCCs with the new ones. For new agreements with new customers, OCLC will incorporate the new SCCs no later than September 28, 2021.