May 8, 2021

Volume XI, Number 128

Advertisement

May 07, 2021

Subscribe to Latest Legal News and Analysis

May 06, 2021

Subscribe to Latest Legal News and Analysis

May 05, 2021

Subscribe to Latest Legal News and Analysis

EU-UK Trade Deal: What It Means For Post-Brexit Data Flows

On December 24, 2020, the European Union and the United Kingdom reached an agreement in principle on the historic EU-UK Trade and Cooperation Agreement (the “Trade Agreement”). For data protection purposes, there is a further transition period of up to six months to enable the European Commission to complete its adequacy assessment of the UK’s data protection laws. For the time being, personal data can continue to be exported from the EU to the UK without implementing additional safeguards.

The UK left the EU on January 31, 2020, and the established transition period will expire on December 31, 2020. Beginning January 1, 2021, the UK will be treated as a third country for purposes of the EU General Data Protection Regulation (“GDPR”). Following the expiration of an additional transition period (explained below), transfers of personal data from the EU to the UK will be prohibited unless EU data exporters take further steps to ensure adequacy for personal data. Those steps include entering into the EU Standard Contractual Clauses, implementing Binding Corporate Rules or relying on any of the available derogations in the GDPR. Both the EU and the UK have expressed a desire to grant formal data protection adequacy status to the UK, which would permit the ongoing free transfer of personal data from the EU to the UK without requiring the exporting or importing organizations to take any further steps.

While the Trade Agreement does not include a determination that the UK provides an adequate level of protection for personal data, it does include transitionary provisions stating that transfers of personal data from the EU to the UK will not be considered transfers of personal data to a third country during the Specified Period, and as such, will not be prohibited by the GDPR.  The Specified Period begins on January 1, 2021, and ends either (1) on the date on which an adequacy decision in relation to the UK is adopted by the European Commission under Article 45(3) of the GDPR, or (2) four months after the Specified Period begins, which shall be extended by two months unless either the EU or the UK objects. The Trade Agreement also includes provisions that may end the Specified Period if the UK makes changes to its data protection legal framework that is in place as of January 1, 2021, unless the EU agrees upon such change.

As a result of these provisions, personal data may continue to be transferred freely between the EU and UK from January 1, 2021, for the duration of the Specified Period. It is expected that a UK adequacy determination will be adopted in 2021, although it remains to be seen whether that will happen before the end of the Specified Period.

The Trade Agreement also includes a number of more general measures relating to data protection and privacy, including commitments by the EU and UK not to enact measures that would restrict cross-border data flows between the EU and the UK or that would otherwise act as data localization requirements.

Transfers of personal data from the UK to the EU (and from the UK to other jurisdictions recognized by the EU as having adequate data protection) will continue to be permitted by the UK beginning January 1, 2021 without requiring additional measures. The UK government has previously indicated that it will recognize existing adequacy determinations and provided for this in the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019.

In a statement published on December 28, 2020, the UK Information Commissioner’s Office (the “ICO”) welcomed the data protection provisions of the Trade Agreement. The ICO said:

“This is the best possible outcome for UK organisations processing personal data from the EU.

This means that organisations can be confident in the free flow of personal data from 1 January, without having to make any changes to their data protection practices.”

The ICO nevertheless recommends that UK-based organizations work with EU organizations to implement cross-border data transfer arrangements to safeguard against any future interruption to the free flow of personal data between the EU and the UK.

Although the Trade Agreement will take provisional effect on January 1, 2021, it must be adopted by the European Council and consented to by the European Parliament before it can be ratified and fully implemented. The Trade Agreement will also need to be approved by the UK Parliament.

Advertisement
Copyright © 2021, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume X, Number 363
Advertisement
Advertisement

TRENDING LEGAL ANALYSIS

Advertisement
Advertisement

About this Author

In today’s digital economy, companies face unprecedented challenges in managing privacy and cybersecurity risks associated with the collection, use and disclosure of personal information about their customers and employees. The complex framework of global legal requirements impacting the collection, use and disclosure of personal information makes it imperative that modern businesses have a sophisticated understanding of the issues if they want to effectively compete in today’s economy.

Hunton Andrews Kurth LLP’s privacy and cybersecurity practice helps companies manage data and...

212 309 1223 direct
Advertisement
Advertisement