Brexit and Data Transfers
Updated 28th Jun 2021
European Commission (EC) has granted the UK Data Protection Act (2018) adequacy with GDPR (2016) with a clause to revoke this if the EC decides that the UK does not offer EU citizens sufficient protection. This will be reassessed in 4 years time.
The decision provides UK businesses transacting with EU customers a welcome relief.
Before the adequacy decision
The EU-UK Trade and Cooperation Agreement concluded between the EU and the UK on December 24th 2020 sets out preferential arrangements in areas such as trade in goods and services.
UK becomes a "Third country"
On the subject of data transfers for business and law enforcement purposes, can continue until adequacy decisions under the EU General Data Protection Regulation and the Law Enforcement Directive are approved before the end of a six-month grace period.
six-month grace period
In the medium term, beyond the 6 months, conferring an adequacy decision on the UK will require a proposal from the European Commission, an opinion from the European Data Protection Board, approval by EU member state representatives and an adopting decision by the commissioners.
Temporary adequacy is a pragmatic and low-risk approach by both parties, since the UK and the ICO have been advocates of GDPR and the Data Protection Directive (1995) along with the other European Supervisory Authorities. Also the UK enacted Data Protection Act (2018) which is broadly similar to GDPR.
What can go wrong?!
The "broadly" bit is likely to highlighted along the lines of Schrems II, chiefly on the UK-USA data transfer agreement and the potential of mass surveillance by USA or UK authorities. In my opinion, this will be a potential stumbling block for the EU to grant the UK DPA (2018) adequacy.
The test will come after this interim period, where one would hope that this pragmatic approach is extended beyond the interim with minimal political posturing and instead concentrate on delivering what's good for the data subject.
This will set the standards for data transfer agreements with other territories such as the USA and the other countries deemed to be ok for Data Protection Directive (1995). It would not bode well if the bar was set unnecessarily high.
The stakeholders and the European Commission have one eye on the need to not stifle business, another on data subject's rights, one on Schrems II and another on Adequacy for third countries.
The UK Information Commissioner's Office noted that as "a sensible precaution, before and during this period, the ICO recommends that businesses work with EU and (European Economic Area) organisations who transfer personal data to them, to put in place alternative transfer mechanisms, to safeguard against any interruption to the free flow of EU to (UK) personal data."
The U.K. had already deemed the EU and EEA states to be adequate for the flow of data from the U.K.
"This is the best possible outcome for UK organisations processing personal data from the EU," Information Commissioner Elizabeth Denham said. "This means organisations can be confident in the free flow of personal data from (January 1), without having to make any changes to their data protection practices.
Another impact of Brexit for the UK is the "one-stop shop" mechanism will no longer apply in the as of Jan. 1. Data controllers and processors established only in the UK that are subject to Article 3(2) of the GDPR will be required to now appoint a representative in the EU (GDPR Article 27).
My other GDPR/DPA articles
GDPR - The big fines have started
Do you know what you have? Do you know what you're doing with it?
The Queen's speech on enacting GDPR into British law
GDPR flies in the ointment - The question of equivalence and adequacy post-Brexit
GDPR - Nothing doing with us, were leaving the EU
Further reading and references
https://www.lawfareblog.com/what-does-schrems-ii-mean-uk
https://www.natlawreview.com/article/schrems-ii-what-does-cjeu-s-decision-mean-transfers-eea-to-us
https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/12/ico-statement-in-response-to-uk-governments-announcement-on-the-extended-period-for-personal-data-flows-that-will-allow-time-to-complete-the-adequacy-process/
https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/12/ico-calls-on-uk-businesses-to-prepare-to-keep-data-flowing-at-the-end-of-the-transition-period/
https://ec.europa.eu/info/relations-united-kingdom/eu-uk-trade-and-cooperation-agreement_en
https://brexit.freshfields.com
Personal commentary. Views are the author’s own.