Worried about personal data transfers post Brexit? If so, you will be pleased to hear that the European Commission’s Task Force for Relations with the United Kingdom (UKTF) has held internal preparatory discussions about a possible UK adequacy decision. With trade and data exchange being at the heart of the future relationship between the EU and UK, the prospects for an adequacy decision are rather positive.
If adequacy is granted, the free flow of personal data between parties in the EU and the UK will continue after the transition period without the need for the parties to arrange for model clauses, BCRs or another transfer mechanism. According to the slides recently published by UKTF, negotiations will take place during the transition period which will run from 1 February until 31 December 2020. Since the UK is expected to remain in the single market and customs union during that period, it is likely to be business as usual for data flows for now. Equally, GDPR representatives in the EU may not have to be appointed until after the transition period.
However, all this depends on the withdrawal agreement bill which is currently going through the House of Lords and will require ratification by the European Parliament. The ICO is expected to update its Brexit guidance after this process. All going well and the UK leaving on 31 January with agreement, the question will then be, can the UK offer a level of protection for personal data essentially equivalent to that of the EU? The Commission’s assessment will start as soon as possible after the UK’s expected departure.
The focus is on adequacy in relation to law enforcement but also commercial data flows. Free flow of data is an essential prerequisite for any future cooperation. Alternative mechanisms are “less comprehensive, less practical and more complex to put in place”. It seems the importance of an adequacy decision for both parties is on par with cooperation and equivalence in financial services. The final adoption of an adequacy decision will require a vote by EU member states.
There is still lots of work to be done on both sides but it is good to see that efforts are underway.
In view of the importance of data flows and exchanges across the future relationship, the Parties are committed to ensuring a high level of personal data protection to facilitate such flows between them.