Share This Article
The agreement reached between the EU and the UK on Brexit also addresses the regime for transfers of personal data, with some unexpected developments.
It is not a surprise that the EU-UK trade cooperation agreement has a section dedicated to data protection matters. In particular, the privacy-related terms of the Brexit deal provides in relation to data transfers that
- there will be a maximum 6-month transitional period in which transfers of personal data from the EU towards the UK will be free with the UK that will not be considered to a “third country” and therefore no standard contractual clauses or other means provided by articles 46 or 49 of the GDPR will be necessary, and likewise
- During such a period, the UK recognized EEA privacy laws to be adequate for data transfers from the UK to the EEA; but
- The transitional period might be shorter if the European Commission early adopts a decision of adequacy; and
- To ensure that the UK does not become the door to uncontrolled transfers towards third countries, during the transitional period, the UK will not issue Art 45 adequacy decisions or Art 46 approved safeguards for transfers without prior EU approval.
The above means that there is no actual tradeoff. No final decision has been taken on personal data transfers, and the match is still quite open. There is no doubt that both parties are willing to find a reasonable agreement with a decision by the European Commission that UK laws offer an adequate level of data protection. The transitional period might be the nascent state of an adequacy decision.
Indeed, the agreement provides that
the Parties are committed to ensuring cross-border data flows to facilitate trade in the digital economy.
which is a relevant cue in the right direction.
Besides, there is no reference to the UK authorities’ presence in any EU data protection body, including the European data protection board during such a period. The UK will rely on this “special regime” for a transitional period and will have restrictions on its “designated powers” which shows that the EU is quite wary of potential actions from the UK government to undermine the safeguards adopted within the EU to protect personal data. And this risk has further increased after the Schrems II decision, where opposite views had been taken by the parties.
The upcoming months are still uncertain, and the EU and UK authorities will still have a hard pivot during this semester. At least businesses have been given additional 6 months to get ready for the worst i.e., the lack of an adequacy decision which still is an option on the table. And, due to the attitude of the latest arrangments around Brexit, it appears likely that the circumstances will remain unclear up to the very last days of the transitional period…
In the meantime, a safe approach would be to run a transfer impact assessment also for transfers towards the UK. In this respect, some support can be given by DLA Piper transfer impact assessment methodology and our legal tech tool named “Transfer”.
