Privacy & Information Security Law Blog

On December 24, 2020, the European Union and the United Kingdom reached an agreement in principle on the historic EU-UK Trade and Cooperation Agreement (the “Trade Agreement”). For data protection purposes, there is a further transition period of up to six months to enable the European Commission to complete its adequacy assessment of the UK’s data protection laws. For the time being, personal data can continue to be exported from the EU to the UK without implementing additional safeguards.

The UK left the EU on January 31, 2020, and the established transition period will expire on December 31, 2020. Beginning January 1, 2021, the UK will be treated as a third country for purposes of the EU General Data Protection Regulation (“GDPR”). Following the expiration of an additional transition period (explained below), transfers of personal data from the EU to the UK will be prohibited unless EU data exporters take further steps to ensure adequacy for personal data. Those steps include entering into the EU Standard Contractual Clauses, implementing Binding Corporate Rules or relying on any of the available derogations in the GDPR. Both the EU and the UK have expressed a desire to grant formal data protection adequacy status to the UK, which would permit the ongoing free transfer of personal data from the EU to the UK without requiring the exporting or importing organizations to take any further steps.

While the Trade Agreement does not include a determination that the UK provides an adequate level of protection for personal data, it does include transitionary provisions stating that transfers of personal data from the EU to the UK will not be considered transfers of personal data to a third country during the Specified Period, and as such, will not be prohibited by the GDPR.  The Specified Period begins on January 1, 2021, and ends either (1) on the date on which an adequacy decision in relation to the UK is adopted by the European Commission under Article 45(3) of the GDPR, or (2) four months after the Specified Period begins, which shall be extended by two months unless either the EU or the UK objects. The Trade Agreement also includes provisions that may end the Specified Period if the UK makes changes to its data protection legal framework that is in place as of January 1, 2021, unless the EU agrees upon such change.

As a result of these provisions, personal data may continue to be transferred freely between the EU and UK from January 1, 2021, for the duration of the Specified Period. It is expected that a UK adequacy determination will be adopted in 2021, although it remains to be seen whether that will happen before the end of the Specified Period.

The Trade Agreement also includes a number of more general measures relating to data protection and privacy, including commitments by the EU and UK not to enact measures that would restrict cross-border data flows between the EU and the UK or that would otherwise act as data localization requirements.

Transfers of personal data from the UK to the EU (and from the UK to other jurisdictions recognized by the EU as having adequate data protection) will continue to be permitted by the UK beginning January 1, 2021 without requiring additional measures. The UK government has previously indicated that it will recognize existing adequacy determinations and provided for this in the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.

In a statement published on December 28, 2020, the UK Information Commissioner’s Office (the “ICO”) welcomed the data protection provisions of the Trade Agreement. The ICO said:

“This is the best possible outcome for UK organisations processing personal data from the EU.

This means that organisations can be confident in the free flow of personal data from 1 January, without having to make any changes to their data protection practices.”

The ICO nevertheless recommends that UK-based organizations work with EU organizations to implement cross-border data transfer arrangements to safeguard against any future interruption to the free flow of personal data between the EU and the UK.

Although the Trade Agreement will take provisional effect on January 1, 2021, it must be adopted by the European Council and consented to by the European Parliament before it can be ratified and fully implemented. The Trade Agreement will also need to be approved by the UK Parliament.