EU-UK commerce deal: what this implies for post-Brexit information flows
On December 24, 2020, the European Union and the United Kingdom reached an agreement in principle on the historic EU-United Kingdom trade and cooperation agreement (the “Trade Agreement”). For privacy reasons, there is an additional transition period of up to six months to allow the European Commission to complete its adequacy assessment of UK data protection laws. Currently, personal data can still be exported from the EU to the UK without the need for additional protective measures.
The UK left the EU on January 31, 2020 and the transition period that has been set expires on December 31, 2020. From January 1, 2021, the United Kingdom will be treated as a third country within the meaning of the EU General Data Protection Regulation (“GDPR”). After an additional transition period (see below), the transfer of personal data from the EU to the UK is prohibited unless the EU data exporters take further steps to ensure the adequacy of personal data. These steps include entering into the EU standard contractual clauses, implementing binding company rules, or using one of the available exemptions in the GDPR. Both the EU and the UK have expressed a desire to grant the UK a formal data protection status that would allow the continued transfer of personal data from the EU to the UK free of charge without further action by the exporting or importing organizations.
While the trade agreement does not contain a provision that the UK provides an adequate level of protection for personal data, it does contain transitional provisions stating that transfers of personal data from the EU to the UK are not considered transfers of personal data to any third party during the specified country Period and as such is not prohibited by the GDPR. The specified period begins on January 1, 2021 and ends either (1) the day the European Commission makes an adequacy decision in relation to the United Kingdom under Article 45 (3) of the GDPR, or (2) four months after the start of the period which will be extended by two months unless the EU or the UK objects. The trade agreement also contains provisions that can end the specified period if the United Kingdom makes changes to its data protection framework in force on January 1, 2021, if the EU does not agree to such a change.
As a result of these provisions, personal data can continue to be freely transferred between the EU and the UK from January 1, 2021 for the specified period. A UK adequacy provision is expected to be passed in 2021. However, it remains to be seen whether this will happen before the end of the specified period.
The trade agreement also includes a number of more general measures related to data protection and privacy, including commitments by the EU and the UK not to take any action that would restrict the flow of data across borders between the EU and the UK or otherwise serve as data location requirements.
The UK will continue to allow transfers of personal data from the UK to the EU (and from the UK to other jurisdictions recognized by the EU as adequate under data protection law) from January 1, 2021 without additional action. The UK government has previously announced that it will recognize existing adequacy provisions and will do so in the Data Protection, Data Protection and Electronic Communications (amendments, etc.) (EU exit) 2019 provisions.
In a statement released on December 28, 2020, the Office of the UK Information Commissioner (the “ICO”) welcomed the data protection provisions of the trade agreement. The ICO said:
“This is the best possible result for UK organizations processing personal data from the EU.
This means that from January 1st, companies can trust the free flow of personal data without having to make any changes to their privacy practices. “
The ICO nonetheless recommends that UK-based organizations work with EU organizations to enter into cross-border data transfer arrangements to prevent any future disruption to the free flow of personal data between the EU and the UK.
Although the trade agreement will tentatively enter into force on January 1, 2021, it must be adopted by the European Council and approved by the European Parliament before it can be ratified and fully implemented. The trade deal also needs to be approved by the UK Parliament.