Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Exhibit B establishes that EU and UK personal data transfers from clients to Plaid in the US are governed by Standard Contractual Clauses defined as the 2004/915/EC Commission Decision, which is a superseded set of SCCs predating the European Commission's 2021 SCC update issued following the Schrems II ruling.
This analysis describes what Plaid's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision identifies the governing SCC instrument as 2004/915/EC, a Commission Decision from 2004 that was superseded by updated Standard Contractual Clauses adopted by the European Commission in June 2021 in response to the Court of Justice of the EU's Schrems II judgment. Organizations relying on this transfer mechanism for GDPR Article 46 compliance should assess whether this instrument satisfies current regulatory requirements.
Interpretive note: Whether the 2004/915/EC SCC instrument remains operative or has been superseded in practice by a separate data processing agreement between Plaid and its clients cannot be determined from this document alone; legal evaluation of the current transfer mechanism is required.
Under this clause, personal data transfers from EU, UK, and Swiss End Users to Plaid's US operations are governed by SCCs referencing a 2004 Commission Decision that has been superseded. The European Data Protection Board and national supervisory authorities have established transitional deadlines for migration to updated SCCs, and the adequacy of the legacy instrument as a current transfer mechanism may require independent legal assessment.
Cross-platform context
See how other platforms handle EU Data Transfer via Legacy Standard Contractual Clauses and similar clauses.
Compare across platforms →Monitoring
Plaid has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If the Privacy Shield has been invalidated or if Plaid does not maintain an active certification under the Privacy Shield, then any such data transfer will be conducted pursuant to the Standard Contractual Clauses (which will be deemed executed and signed, where appropriate, by the parties as of the Effective Date), and the following terms will apply: (i) Client will be referred to as the "data exporter" and Plaid will be referred to as the "data importer" in such clauses with relevant details from this Exhibit B being used accordingly... "Standard Contractual Clauses" means 2004/915/EC: Commission Decision of 27 December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries.Excerpt from Plaid's Terms of Use
REGULATORY LANDSCAPE: GDPR Article 46 requires that cross-border personal data transfers to third countries without an adequacy decision be conducted pursuant to appropriate safeguards, including Standard Contractual Clauses. The European Commission adopted updated SCCs in June 2021 following the Court of Justice of the EU's invalidation of Privacy Shield in Data Protection Commissioner v. Facebook Ireland Limited (Schrems II). The 2004/915/EC SCCs referenced in this document were superseded and the European Data Protection Board established a transitional period for organizations to migrate to the 2021 SCCs. The UK GDPR imposes parallel obligations under UK data protection law, and the ICO has issued separate guidance on international data transfers. The reference to Privacy Shield as a potential active transfer mechanism is also notable given its invalidation by the CJEU in 2020, though the EU-U.S. Data Privacy Framework adopted in 2023 may be relevant context. GOVERNANCE EXPOSURE: High. Organizations processing EU or UK End User personal data through Plaid under this agreement should assess whether the data transfer mechanism identified in Exhibit B provides a legally valid basis for transfers under current GDPR and UK GDPR requirements. Reliance on superseded SCCs may constitute a GDPR violation subject to enforcement by national supervisory authorities and fines under GDPR Article 83. JURISDICTION FLAGS: This provision is directly relevant to EU/EEA and UK-based clients, as well as any client whose End Users are located in the EU, UK, or Switzerland. German, French, Irish, and Dutch data protection authorities have been active in enforcing international transfer requirements. UK clients face parallel requirements under the UK GDPR and the ICO's international transfer guidance. CONTRACT AND VENDOR IMPLICATIONS: Legal and compliance teams should request that Plaid confirm whether updated 2021 SCCs or the EU-U.S. Data Privacy Framework serve as the current operative transfer mechanism, and whether this document has been superseded by more recent data processing agreements. The clause states that SCCs are deemed executed as of the Effective Date, which may have implications for when contractual transfer protections attach. COMPLIANCE CONSIDERATIONS: Organizations subject to GDPR should conduct a transfer impact assessment and verify which transfer mechanism is currently operative for data flows to Plaid. If the 2004/915/EC SCCs are the only identified mechanism and no supplementary agreement adopting the 2021 SCCs exists, legal counsel should advise on remediation steps including renegotiation of data transfer terms.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
The provision identifies the governing SCC instrument as 2004/915/EC, a Commission Decision from 2004 that was superseded by updated Standard Contractual Clauses adopted by the European Commission in June 2021 in response to the Court of Justice of the EU's Schrems II judgment. Organizations relying on this transfer mechanism for GDPR Article 46 compliance should assess whether this instrument satisfies …
Under this clause, personal data transfers from EU, UK, and Swiss End Users to Plaid's US operations are governed by SCCs referencing a 2004 Commission Decision that has been superseded. The European Data Protection Board and national supervisory authorities have established transitional deadlines for migration to updated SCCs, and the adequacy of the legacy instrument as a current transfer mechanism …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Plaid.