Data Transfers from the European Union to the United Kingdom Will Continue as EU Commission Assesses Adequacy during Six Month Transition Period
The European Commission now has an additional six months to complete its adequacy assessment of the UK’s data protection laws, thanks to an agreement in principle reached by the European Union and the United Kingdom regarding the EU-UK Trade and Cooperation Agreement (“the Agreement”). As a result, companies can – at least for now – continue to move data from the EU to the UK without putting in place additional safeguards.
The UK’s transition out of the EU ended December 31, 2020, and as of January 1, 2021 it is treated as a third country for purposes of the EU General Data Protection Regulation (“GDPR”). Article 45 of the GDPR allows the transfer of data only to third countries found by the EU Commission to provide adequate protection for the data of EU residents. The Agreement provides a transition period of up to six months to allow the European Commission to conduct its assessment of whether the UK’s data protection laws provide such protection. When the transition period expires, transfers of personal data from the EU to the UK will be prohibited unless EU data exporters implement supplemental measures including EU Standard Contractual Clauses, Binding Corporate Rules, or rely on any of the available derogations in the GDPR.
The UK Information Commissioner’s Office (the “ICO”) welcomed the data protection provisions of the Trade Agreement. In a December 28, 2020 statement the ICO said:
“This is the best possible outcome for UK organisations processing personal data from the EU. This means that organisations can be confident in the free flow of personal data from 1 January, without having to make any changes to their data protection practices.”
In the interest of maintaining the free flow of personal data between the EU and the UK, the ICO recommends that UK-based companies work with companies in the EU to implement cross-border data transfer arrangements.
The Trade Agreement, which took provisional effect on January 1, 2021, must be adopted by the European Council and consented to by the European Parliament before it can be ratified and fully implemented. It must also be approved by the UK Parliament.