What EU-UK Trade Deal Means For Post-Brexit Data Flows

On December 24, 2020, the European Union and the UK reached an settlement in precept on the historic EU-UK Trade and Cooperation Agreement (the “Commerce Settlement”). For information safety functions, there’s a additional transition interval of as much as six months to allow the European Fee to finish its adequacy evaluation of the UK’s information safety legal guidelines. In the meanwhile, private information can proceed to be exported from the EU to the UK with out implementing further safeguards.

The UK left the EU on January 31, 2020, and the established transition interval will expire on December 31, 2020. Starting January 1, 2021, the UK will probably be handled as a 3rd nation for functions of the EU Basic Knowledge Safety Regulation (“GDPR”). Following the expiration of an extra transition interval (defined beneath), transfers of non-public information from the EU to the UK will probably be prohibited until EU information exporters take additional steps to make sure adequacy for private information. These steps embrace getting into into the EU Normal Contractual Clauses, implementing Binding Company Guidelines or counting on any of the accessible derogations within the GDPR. Each the EU and the UK have expressed a want to grant formal information safety adequacy standing to the UK, which might allow the continued free switch of non-public information from the EU to the UK with out requiring the exporting or importing organizations to take any additional steps.

Whereas the Commerce Settlement doesn’t embrace a dedication that the UK gives an satisfactory stage of safety for private information, it does embrace transitionary provisions stating that transfers of non-public information from the EU to the UK won’t be thought-about transfers of non-public information to a 3rd nation in the course of the Specified Interval, and as such, won’t be prohibited by the GDPR.  The Specified Interval begins on January 1, 2021, and ends both (1) on the date on which an adequacy determination in relation to the UK is adopted by the European Fee underneath Article 45(3) of the GDPR, or (2) 4 months after the Specified Interval begins, which shall be prolonged by two months until both the EU or the UK objects. The Commerce Settlement additionally contains provisions that will finish the Specified Interval if the UK makes modifications to its information safety authorized framework that’s in place as of January 1, 2021, until the EU agrees upon such change.

Because of these provisions, private information could proceed to be transferred freely between the EU and UK from January 1, 2021, throughout the Specified Interval. It’s anticipated {that a} UK adequacy dedication will probably be adopted in 2021, though it stays to be seen whether or not that can occur earlier than the top of the Specified Interval.

The Commerce Settlement additionally contains a lot of extra basic measures regarding information safety and privateness, together with commitments by the EU and UK to not enact measures that will prohibit cross-border information flows between the EU and the UK or that will in any other case act as information localization necessities.

Transfers of non-public information from the UK to the EU (and from the UK to different jurisdictions acknowledged by the EU as having satisfactory information safety) will proceed to be permitted by the UK starting January 1, 2021 with out requiring further measures. The UK authorities has beforehand indicated that it’ll acknowledge present adequacy determinations and supplied for this within the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.

In a statement revealed on December 28, 2020, the UK Data Commissioner’s Workplace (the “ICO”) welcomed the info safety provisions of the Commerce Settlement. The ICO mentioned:

“That is the very best end result for UK organisations processing private information from the EU.

Because of this organisations could be assured within the free circulation of non-public information from 1 January, with out having to make any modifications to their information safety practices.”

The ICO nonetheless recommends that UK-based organizations work with EU organizations to implement cross-border information switch preparations to safeguard towards any future interruption to the free circulation of non-public information between the EU and the UK.

Though the Commerce Settlement will take provisional impact on January 1, 2021, it should be adopted by the European Council and consented to by the European Parliament earlier than it may be ratified and absolutely applied. The Commerce Settlement can even must be permitted by the UK Parliament.