Data Transfers after Brexit

To the relief of many, the fear of the Brexit transition period coming to an end in December 2020 without the EU and UK having agreed a free trade agreement didn’t materialise. The Trade and Cooperation Agreement (TCA) negotiated by the EU and the UK gave welcome certainty in many areas but a final position regarding the transfer of personal data between the EU and the UK was not in fact one of them.

By way of a reminder, while the UK was a member of the EU personal data was able to flow freely between the EU and the UK as part the “four freedoms” of the single market – the free movement of goods, capital, services and labour. The freedom to transfer personal data also continued during the Brexit transition period but once this came to an end it was expected that the free movement of personal data would come to an end and the UK would be subject to the same rules regarding data transfers as the rest of the world. Under the EU’s General Data Protection Regulation (GDPR) personal data cannot be transferred out of the EU to a “third country” except in accordance with one of the different tools provided for in the GDPR. This restriction was put in place to protect against the possibility that the data protection regime in the third country may be less protective of the rights and freedoms of EU citizens than the EU’s own regime.

The two most common tools relied upon are:

• An adequacy decision, i.e. where the European Commission makes a declaration that the data protection regime in the third country is “adequate”, i.e. equivalent to the EU’s own regime, and therefore no additional safeguards are needed before transferring personal data from the EU to that third country.
• The EU’s standard contractual clauses (also referred to as the SCCs or the model clauses). These are a set of clauses, approved by the EU. When they are incorporated into a contract pursuant to which personal data is to be transferred from the EU to a third country, they create binding commitments to safeguard the data. It is important to stress, however, that the SCCs should not be treated as a “paper shuffling” exercise and the data exporter should undertake a risk assessment as to whether the SCCs will be an effective safeguard in the jurisdiction to which the personal data is to be transferred. Depending on the outcome of this, supplementary measures may be required or the exporter may conclude that the transfer should not go ahead.

For organisations involved with the export of personal data, an adequacy decision is good news because at the organisation level no additional action is required. However may businesses and organisations needing personal data to continue flowing freely from the EU to the UK after the end of the Brexit transition period were concerned about a possible “no deal” outcome at the end of the Brexit transition period and therefore took the precaution of incorporating the SCCs into their contracts.

However in the short term this proved unnecessary because although an adequacy decision has not been made as part of the FCA, the EU and the UK have agreed to an extended transition period in relation to the transfer of personal data, for between 4 to 6 months, i.e. until the end of April 2021 or June 2021. This means that, for the time being at least, organisations can continue to transfer personal data between the EU and the UK without taking any additional action.

It is to be hoped that by the end of the extended transition period the EU will make an adequacy decision in relation to the UK so that the status quo can continue indefinitely. However if this is not forthcoming, then alternative mechanisms such as the SCCs will need to be revisited. The current versions of the SCCs date back to 2010 but the EU is presently in the process of approving updated versions of these documents and it is to be hoped that, if an adequacy decision is not made and SCCs are needed, the latest versions of the SCCs will have been approved by that stage.

If you have any questions or would like further information about issues arising from this article, please contract Cathrine Ripley at [email protected].