New standard contractual clauses require third-party beneficiary rights
The European Commission has, following the now well-known decision of the Court of Justice of the EU, i.e. Schrems II, which repealed the Privacy Shield, adopted new standard contractual clauses that can serve as a basis for the transfer of personal data to third countries. They entered into force on 27 June 2021.
In its decision to repeal the Privacy Shield, the Court of Justice (among others) emphasized the importance of respect for the rule of law and the possibility of access to legal recourse for individuals in such a third country, leading the EDPB (European Data Protection Board) to make comprehensive recommendations on how the entities transferring data to third countries are to ensure its security. The EDPB’s recommendations are exceptionally detailed and extremely (too?) strict for those who transfer data to third countries. In the light of the judgment and the recommendations, the “old” standard contractual clauses proved to be inappropriate, which led to the adoption of new ones by the European Commission on 4 June 2021.
The new standard contractual clauses (SCCs) are composed modularly, and allow the contracting parties to choose the appropriate parts of the clauses according to different situations and relationships. Among other things, they stipulate that the parties may choose the law of any EU Member State, under one condition – this law must allow for third party beneficiary rights. In the light of the latter, the parties of the SCCs must ascertain whether and which EU Member States allow such rights.
Slovenian law, more precisely the Code of Obligations, regulates contracts in favor of a third party in a special chapter. Pursuant to Article 126 of the Code of Obligations, the third party acquires his own and direct right against the debtor, unless otherwise agreed. It therefore enables third-party beneficiary rights, which the latter can exercise directly and (unless otherwise agreed) without restrictions, which means that the contracting parties can also choose Slovenian law as the law applicable to them under the new standard contractual clauses.
It is already possible to apply the standard contractual clauses in the new form, but it is also allowed to conclude the old standard contractual clauses until 27 September 2021. A longer transitional period is foreseen (until 27 December 2022), after which it will be necessary to move to new standard contractual clauses – from this date all contracts will have to be adjusted to these new clauses and the use of “old” ones will no longer be a valid legal basis for transfer of personal data to third countries.
