As we reported last year, the invalidation of the EU-U.S. Privacy Shield on July 16, 2020 is forcing the hand of U.S. companies which access the personal data of EU residents to find a new, lawful mechanism by which to do so in accordance with EU data protection laws. One such alternative – the use of the EU’s standard contractual clauses (SCCs) (a/k/a “Model Clauses”) – was recently bolstered by much-needed proposed updates to the clauses themselves.

Many U.S.-based life sciences companies outsource their clinical trial needs to laboratories outside of the U.S., including labs located in the European Union (EU). Others conducting clinical trials in the U.S. may be involved with the collection and processing of EU patients’ data in some other capacity. Despite the benefits of such international cooperation, these arrangements trigger an array of compliance obligations for U.S. companies under a number of EU laws[1], including the General Data Protection Regulation (GDPR) and its rules pertaining to data processing activities.