Data protection teams can breathe a sigh of relief that the EU/UK Trade and Cooperation Agreement includes interim provision allowing the continued transmission of personal data from the EU to the UK.
Personal data can only be transferred from the EEA to a non-EEA country without the need for further safeguards if the European Commission has determined that the other country offers an adequate level of data protection. If there is no such “adequacy decision”, personal data can only be transferred outside the EEA if the transfer is covered by appropriate safeguards (such as intra-group binding corporate rules or standard contractual (“model”) clauses), or an exception applies - for example, the transfer is necessary for the performance of a contract, or the data subject has given his or her explicit, specific informed consent, or the transfer is necessary to protect the vital interests of the data subject who is incapable of giving consent.
The European Commission has not yet made an “adequacy decision” in respect of the UK. However the EU/UK Trade and Cooperation Agreement allows personal data to continue to flow from the EU to the UK so long as i) UK data protection law is unchanged from the position as at 31 December 2020, and ii) the UK doesn’t exercise any “designated power” without EU agreement. These designated powers include introducing new standard/model clauses, or new codes of conduct or certification mechanisms, or new binding corporate rules.
This interim provision will also apply to transfers to the UK from Iceland, Liechtenstein and Norway if each of these countries notifies the EU and the UK that it agrees.
The interim provision will last until there is an adequacy decision, but subject to a maximum period of 4 months, which can be extended by a further 2 months unless either the UK or the EU objects. The interim provision will also end if the UK exercises any designated power without the agreement of the EU (unless the UK is simply aligning UK law with EU law). All or part of the Law Enforcement & Judicial Co-operation Part of the EU/UK Trade and Cooperation Agreement can also be suspended if there are serious deficiencies in data protection including if any adequacy decision is revoked.
ArticleFINPROV.10A of the EU/UK Trade and Cooperation Agreement (pages 406-407).
The EU and UK have also made a JointDeclaration noting the European Commission’s intention to promptly launchthe procedure for the adoption of adequacy decisions with respect to the UK.
Data protection teams can breathe a sigh of relief - for a little while ...