Brexit Deal and Data Transfers

Philippa Donn

Data Transfers: Trade Deal confirms free flow of data for the time being

Fears the free flow of data from the European Economic Area to the UK would end on 1st January 2021 have been averted with the Brexit Trade Deal. But we’re not quite out of the woods yet.

We still need to wait and see if the European Commission will grant the UK what’s termed ‘adequacy’. This is a separate process to the Trade Deal.

Adequacy is granted to non-EEA countries (‘third’ countries) which are carefully assessed and judged to provide a level of data protection which is essentially equivalent to that provided by the EU.

Adequacy would mean there was no requirement for organisations based in EEA countries to put in place additional safeguard mechanisms when transferring data to the UK. Such safeguards include Standard Contractual Clauses and Binding Corporate Rules.

(The UK for its part has said data transfers from the UK to the EEA can continue without additional measures being required, but will keep this under review).

The Trade Deal confirms we have now entered an interim period lasting up to a maximum of six months, during which time the UK will not technically be treated as a third country.

This has been welcomed by the Information Commissioner’s Office which said it ‘will enable businesses and public bodies across all sectors to continue to freely receive data from the EU (and EEA), including law enforcement agencies.’

How the ‘interim period’ works

The interim period started on 1st January and ends when either an adequacy decision is adopted by the EC or after four months. This period can then be extended by a further two months unless either the EU or UK objects.

Is the UK likely to be granted adequacy?

In the week’s leading up to the eleventh-hour trade deal, there was increasing nervousness surrounding an adequacy decision. Yes, we do still need to wait, but I am now more positive the UK will be declared adequate.

The main stumbling block remaining is the UK’s Investigatory Powers Act 2016. A ruling in October by the Court of Justice of the European Union (CJEU) found UK law permitting intelligence agencies to collect bulk communications data was incompatible with EU law. This ruling could still prove significant in any EC decision. 

But there are good reasons to be hopeful the EC will declare the UK adequate, such as;

• the Trade Deal confirms a commitment by the UK and the EU to maintaining high standards of data protection
• the UK Government has always intended to implement GDPR into UK law; ‘UK GDPR’
• the UK co-authored GDPR in the first place
• Not granting the UK adequacy would set the bar incredibly high for other adequacy decisions in future. Talks are, for example, currently underway between the EC and South Korea
• A ‘no’ could potentially call into question existing decisions. Could the UK data protection regime really be considered inferior to countries like New Zealand, Argentina, Israel and Japan, which have adequacy?

While I am hopeful the EC will say ‘yes’ and foresee a degree of political will to complete this process within six months, it’s clearly not 100% guaranteed.

What actions should you take?

Over the past year (and more) many organisations, anticipating a potential ‘no deal’ scenario and no adequacy, have focused on the compliance of their international transfers.

For many this has meant updating contracts to include additional safeguards, such as Standard Contractual Clauses (SCCs). These are similar to arrangements required to be in place for data transfers to third countries such as US and Australia.

Working to make sure additional safeguards are place is a precautionary measure the UK regulator is still advising you do:

“The ICO recommends that businesses work with EU and EEA organisations who transfer personal data to them, to put in place alternative transfer mechanisms, to safeguard against any interruption to the free flow of EU to UK personal data.”

It’s worth noting the Trade Deal requires the UK to toe the line if it wishes to benefit from the free flow of data during the interim period. If in the coming months the UK makes any changes to its data protection laws, including privacy and electronic communications rules, the interim period will automatically end. (Unless such changes are agreed by the EU).

Even if the UK is granted adequacy, there’s still a chance such a decision could be challenged. We all saw how the EU-US Privacy Shield was ruled invalid early this year Schrems II ruling. There are however measures within the Trade Deal to try and prevent such matters reaching the courts.

The Trade Deal covers other nuanced details about data protection matters, and if you would like more information, I encourage you to read articles by Field Fisher’s Eleanor Duhs and the Data Protection Lawyer Katie Hewson.

Philippa Donn, January 2021

Do you have the resources and specialist skills in-house to ensure your data transfers comply? Contact us if you’d like some help. We help many organisations with pragmatic no-nonsense solutions to their data protection challenges.

• Share on LinkedIn
• Share on Twitter