What has happened?

  • The draft UK-EU post-Brexit Trade Deal provides that transfers of data to the UK from EU Member States will not be treated as “restricted transfers” to a non-EU country for a period of up to six months from January 1, 2021.
  • This will also apply to transfers to the UK from EEA Member States, assuming (as appears likely) those States notify the UK and EU of their express acceptance to accede to the relevant provision of the Trade Deal.
  • The intention behind this extension is to give the European Commission more time in which to conclude its adequacy assessment regarding the UK.

What is the key takeaway?

For the time being (see notes on timing below) – personal data can continue to flow from the EEA to the UK without the need for additional safeguards (e.g., entering into Commission-approved Standard Contractual Clauses).

How long is this extended transitional period going to last?

The initial period is four months from January 1, 2021, but it will automatically extend for a further two months unless either the UK or the EU objects to that extension.

However, the period will come to an end if and when:

  • the Commission adopts an adequacy decision in respect of the UK; OR
  • the UK amends the so-called “UK GDPR” or makes certain decisions regarding data transfers under the UK GDPR/UK Data Protection Act 2018 without the consent of the EU (unless those amendments or decisions are made simply to keep the UK laws aligned with the EU data protection regime).  

What next?

This depends on the conclusion of the Commission’s adequacy assessment in respect of the UK.

  • If the Commission does not adopt an adequacy decision in respect of the UK before the expiry of the extended transitional period – from that point onwards, any transfer of personal data from the EEA to the UK will need to be effected subject to EU GDPR-compliant additional safeguards (e.g., entry into Commission-approved Standard Contractual Clauses that will govern and condition such transfer).
  • If the Commission does adopt an adequacy decision in respect of the UK – personal data can continue to flow from the EEA to the UK on the basis of that decision, without the need for additional safeguards.

If you would like any assistance in this area, please contact a member of the Cooley c/d/p team.

Contributors

Leo Spicer-Phelps

Patrick Van Eecke

Posted by Cooley

All Posts