Brexit and the transfer of personal data
- 24th March 2021
- No comments
On 24th December 2020, the United Kingdom and the European Union signed the UK-EU Trade and Cooperation Agreement (TCA) and related agreements. The TCA is the main agreement that will govern the future UK-EU trading relationship following the end of the transition period.
This article is not intended to provide a full review of the TCA (on account of it being over 1,200 pages long) but will instead focus on the impact of the TCA on the transfer of personal data and the relationship between the UK and EU.
What does the TCA say about the UK?
The UK is now deemed a ‘third county’ by the EU for the purposes of the EU General Data Protection Regulation. Ordinarily, this would mean that transfers of personal data could only take place from the EU to the UK if ‘appropriate safeguards’ were implemented for the transfer, or the European Commission had adopted a formal ‘adequacy decision’ recognising the UK as providing an adequate level of protection for personal data.
What happens to UK to EEA data transfers?
The transfers of personal data from the UK to the EU/EEA are largely unaffected and can continue as before.
What happens to EEA to UK data transfers?
The TCA provides states that the transfer of personal data from the EEA to the UK are not treated as transfers to a ‘third county’ until the earlier of:
i. The date on which the European Commission issues an adequacy decision regarding the UK; or
ii. 1st May 2021 (which will automatically be extended to 1st July 2021 unless either side objects).
What does this mean for businesses?
In light of the above, businesses can continue to transfer personal data from the EEA to the UK for the time being without additional compliance measures. However, to safeguard against the possibility of an adequacy decision not being issued within the timeframe mentioned above, businesses may wish to take a precautional approach and begin to review and (if necessary) update their policies and contractual agreements to ensure they are compliant.