What is the “Agreement”?
On 24th December 2020, the European Union and the United Kingdom reached an agreement in principle “the UK-EU Trade and Cooperation Agreement” (the “Agreement”) defining the rules applicable to their relations including in terms of data protection. This Agreement had been awaited in part to determine the rules in terms of data transfer between the two regions.
What does it mean?
The United Kingdom and the European Union have agreed that the “transmission of personal data from the Union to the United Kingdom shall not be considered as transfer to a third country on a transitional basis for a maximum additional period of 6 months, i.e. up to 1st July 2021 (“Specified Period”).
As a result, the United Kingdom is still treated like an EU member state during this Specified Period and it allows a free flow of personal data from the EU to the UK during this Specified Period.
How long is the Specified Period during which the UK is treated like an EU member state?
The Specified Period has started on 1st January 2021 and ends (i) on the date on which an adequacy decision (Article 45 of GDPR) is adopted by the European Commission or (ii) four months from 1st January 2021, which period shall be extended by two further months unless the UK or the EU objects. The Specified Period expires on the latest on 1st July 2021.
What does it mean for my organization in terms of data transfer until 1st July 2021?
Until 1st July 2021, any communication of personal data to the UK will not be considered as a data transfer to a third country:
- Transfer of personal data from the EEA to the UK:
The UK is treated like an EU member state and the transfer of personal data can continue without safeguards (e.g. Standard Contractual Clauses). However, as per First Advantage previous recommendation, it is advisable to continue implementing appropriate safeguards, e.g. to sign the Standard Contractual Clauses where appropriate.
- Transfer of personal data from the UK to the EEA:
The UK has already announced that the EEA states are deemed to be adequate. No further requirements for the time being.
- Transfer of personal data from the UK to the non-EEA states:
So far, the UK has adopted the same rules as the EU and has recognized the EU adequacy decisions (e.g. Andorra, Argentina, Canada – commercial organizations -, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay) and the EU approved transfer safeguards. However, this position may be changed at any time.
What does it mean after 1st July 2021?
At the end of the Specified Period, in the absence of an adequacy decision of the European Commission, any transfer of personal data to the United Kingdom will be considered as a data transfer to a third country. Such transfer can only take place with appropriate safeguards in place as set forth in the GDPR (e.g. standard contractual clauses, binding corporate rules, etc.).
What is the recommendation for the time being?
Although there is no requirement to regulate the flow of personal data to the United Kingdom during the Specified Period, it is recommended as per the Information Commissioner’s Officer recommendation to anticipate and to “put in place “alternative transfer mechanisms, to safeguard against any interruption to the free flow of EU to UK personal data.”
First Advantage recommends that you discuss next steps with your legal team and/or your data privacy team or officer.
For more information, please follow the link to the summary and the Agreement.
Information Content Notice:
The foregoing information is not offered as legal advice but is instead offered for informational purposes. First Advantage is not a law firm and does not offer legal advice. The foregoing information is therefore not intended as a substitute for the legal advice of an attorney knowledgeable of the user’s individual circumstances. First Advantage makes no assurances regarding the accuracy, completeness, currency or utility of the following information. Legislative, regulatory and case law developments regularly impact on general research.
