NEWS “without comment”
EU-UK Trade and Cooperation Agreement: Data Flows Post Brexit
Taylor Vinters LLP
December 29, 2020
Whilst a lot of us were considering whether or not we had room for that additional mince pie, details of the Trade and Cooperation Agreement between the UK and European Union were released.
From a data protection perspective, the outcome looks positive: “The Agreement confirms strong data protection commitments by both the UK and the EU, protecting consumers and helping to promote trust in the digital economy”.
The key news is that there will be a grace period of up to 6 months from 1 January 2021 for transfers of personal data between the UK & EEA whilst UK works towards obtaining an adequacy decision.
What does this mean?
It means that all data transfers during this period can continue uninterrupted and there will be no need to rush to put in place alternative safeguards e.g. the standard contractual clauses. Whilst this is frustrating for those who have taken steps pre-Christmas already, the adequacy decision is not a guaranteed, and these additional safeguards may ultimately still be required. It is more like a probation period rather than a countdown to a confirmed event – there is still work to do.
The ICO has welcomed this decision with Elizabeth Denham, the Information Commissioner describing it “as the best possible outcome for UK organisations processing personal data from the EU”.
Whilst it doesn’t guarantee an adequacy decision at the end of the 6 months, it confirms a real intent to get it sorted in a time period far shorter than we would usually expect to see.
It is worth noting that this doesn’t negate the requirement to have an EU representative if you are based in the UK and do not have a branch, office or other establishment in any other EEA state, but you either:
offer goods or services to individuals in the EEA; or
monitor the behaviour of individuals in the EEA.
Thankfully, “organisations can be confident in the free flow of personal data from 1 January, without having to make any changes to their data protection practices” – hopefully when it comes to the end of this 6 month period we will be clearer as to the steps we will need to take (if any). However, for now, a sigh of relief and business as usual, until the Summer.
See: https://www.lexology.com/library/detail.aspx?g=473ab92b-d5dd-4d06-916b-9b8e8e864d69