Why PWC are working with ThoughtRiver on a technology-driven solution to Schrems II compliance
Looking for a needle in a Haystack has nothing on looking for old SCCs in a digital pile of contracts. For already-stretched teams, it can seem like an impossible task. That’s why PWC are working with ThoughtRiver to provide solutions that make the identification of affected contracts and the subsequent remediation process easier.
PWC has been partners with ThoughtRiver for more than two years, embedding AI contract review technology into our client work to bring about efficiencies, cost savings, and process improvements. They’re now working together to support organizations that need to review, analyze and remediate potentially thousands of contracts covering international data transfers in order to comply with the upcoming deadline imposed by the European Commission as a result of the Schrems II judgment. The burden of work this judgment imposes on organizations is significant, and the pressure is on to identify and remediate affected agreements before the December deadline this year.
What is Schrems II?
Schrems II is a 2020 European court judgement that fundamentally impacts the way in which companies transfer personal data across borders. The decision means that businesses are now required to undertake Transfer Risk Assessments, including specific Country Assessments, before transferring data from the EU and UK to countries which are not deemed ‘Adequate’.
The European Commission has now updated the Standard Contract Clauses (SCCs) to incorporate these obligations. Businesses have been required to use the new SCCs in all new agreements from 27th September 2021. Now organizations have until 27th December 2022 to make sure they have remediated all existing contracts which contain the old SCCs – a task that involves searching through potentially thousands of contracts to identify those which require action.
What actions am I required to take?
Moving to the new SCCs is far from a straightforward process. With less than ten months to go before the deadline the time to act is now. We recommend that organisations take a phased approach to ensure compliance, which is summarised briefly below and can be found in more detailed steps here as set out in this PwC article.
How can ThoughtRiver’s platform help?
ThoughtRiver is making contract review for Schrems II Clauses available out of the box. This will enable customers to review contracts for affected clauses on a contract-by-contract basis, as a set of at-risk contracts (with a macro-level report), and/or as a part of day-to-day contract negotiations alongside other playbook risks.
Here’s how this could look in practice:
Contract-by-contract review
Every contract uploaded into ThoughtRiver’s out-of-the-box platform will be reviewed for SCC compliance. Where required you will be provided with detailed advice notes and a suggested replacement clause from the PWC data privacy team specialists.
Report on a set of contracts
This special Schrems II report inside the ThoughtRiver platform makes it easy to see how many contracts have clauses that need remediating. Bulk upload your contracts and then the Schrems II report will provide a detailed overview of which agreements are affected, along with deep links directly into each contract. For any organization that requires support with this process, or with the resulting triaging and planning, the PWC team are happy to help.
As part of ongoing contract negotiations
ThoughtRiver can be used to help automate the remediation process at a contract and clause level and ensure ongoing compliance in all future contracts. To do this a playbook must be defined with fallback positions and escalation routes. PWC can work with you to create this playbook and then train the ThoughtRiver algorithm making the process quick and straightforward.
What about transfers out of the UK?
For transfers out of the UK we are still awaiting Parliamentary approval for the passing of the UK’s new International Data Transfer Agreement (IDTA), and new International Data Transfer Addendum (the “UK Addendum”) to the European Commission’s new standard contractual clauses – needed as the EU’s new SCCs were passed after Brexit. If the IDTA and UK Addendum pass they will come into force on 21st March 2022. Organizations will then have until 21st September 2022 to start using these new clauses in UK transfers, and until 21st March 2024 to replace the SCCs in existing agreements.
Once this happens the process outlined above can be followed for UK transfer agreements, and the ThoughtRiver platform will be updated accordingly.
Interested in finding out more?
PWC and ThoughtRiver will be hosting a webinar on Thursday 28th April 2022 which outlines everything you need to know about Schrems II, the news SCCs, and the steps you need to date to ensure compliance before the 27th December 2022 deadline.
You can register here.
To trial the ThoughtRiver platform’s capabilities you can sign up for a free trial of the platform and test it on your NDAs. Alternatively, you can contact our sales team to talk about your specific Schrems II use case.
