Bailiwick of Guernsey Addendum to the EU Standard Contractual Clauses

Summary

This is a template addendum published by the Guernsey Data Protection Authority for use alongside the European Commission's Standard Contractual Clauses (SCCs). It allows data exporters and importers to adapt the EU SCCs so that they satisfy the appropriate safeguards requirement under Section 56(2)(c) of the Data Protection (Bailiwick of Guernsey) Law, 2017 for transfers of personal data outside the Bailiwick to a third country or international organisation. It covers controller to controller, controller to processor, processor to controller and processor to processor transfers.

• Purpose: Provides a mechanism for parties to rely on the EU SCCs, modified by this Addendum, as appropriate safeguards for restricted transfers under Guernsey data protection law.
• Key amendments to the Clauses: References to Regulation (EU) 2016/679 are replaced with the Guernsey Data Protection Law and equivalent provisions; references to the Union, EU and EU Member State are replaced with the Bailiwick of Guernsey; references to Regulation (EU) 2018/1725 are removed.
• Supervisory authority and courts: Clause 13(a) and Part C of Annex I are disapplied, with the Data Protection Authority in the Bailiwick of Guernsey named as the competent supervisory authority; Clause 17 is replaced so the Clauses are governed by the law of Guernsey, Alderney or Sark, and Clause 18 gives jurisdiction to the courts of the Bailiwick of Guernsey.
• Hierarchy of terms: Where the Addendum conflicts with the Clauses or other agreements, the provision offering the most protection to data subjects prevails.
• Data subject rights: Data subjects may enforce the Clauses and this Addendum directly against the parties, and each signing party undertakes to comply with the data subject rights provisions.
• Execution options: Parties may incorporate the Addendum by adding specified signature wording to the Clauses, or by amending and executing the Clauses directly in line with the Addendum.

As a form/template rather than a binding rule in itself, the Addendum only creates obligations for the parties who choose to adopt it for a particular data transfer; it does not itself mandate its use for all international transfers.

Key obligations

• Parties relying on this Addendum for a restricted transfer must incorporate the specified amendments to the EU SCCs (e.g. replacing references to EU Regulations with Guernsey Data Protection Law, naming the Guernsey Data Protection Authority as competent supervisory authority, and adopting Guernsey/Alderney/Sark governing law and court jurisdiction).
• Parties must ensure any amendment to the Addendum continues to maintain the appropriate safeguards required by Section 56 of the Data Protection (Bailiwick of Guernsey) Law, 2017.
• Each signing party undertakes to comply with the terms of the Clauses that give data subjects direct rights, allowing data subjects to enforce those rights directly against the parties.
• Parties must execute the Addendum in a manner that makes it legally binding, either by adding specified signature language to the Clauses or by amending and executing the Clauses themselves.

Applies to

data controllers, data processors, data exporters, data importers