The trade deal agreed between the UK and the EU contains interim provisions in relation to data transfers between the UK and EEA member states.
The EU has agreed to permit data flows to continue from the EU to the UK for no longer than six months, until a formal adequacy decision has been made by the EU regarding the UK’s data protection legislative regime. Similarly, the UK has decided that the EEA has (on a transitional basis at least) a data protection framework in place that is adequate to permit transfers of personal data from the UK.
This interim arrangement, until the EU passes an adequacy decision in respect of the UK, means that UK-based businesses can continue to transfer data to customers and suppliers in the EU and, likewise, that EU-based businesses can continue to share data with entities in the UK. The ability to continue to transfer data also applies to public bodies and law enforcement agencies.
However, this is contingent upon the UK government not exercising certain powers under the Data Protection Act 2018, such as approving certification mechanisms or providers or passing an adequacy decision in respect of any third countries. If the UK government exercises any of these powers or amends the UK data protection regime (other than to align with EU law), then the interim arrangements permitting flows of data between the EU and UK will end immediately.
The ICO has welcomed these interim arrangements, with the commissioner, Elizabeth Denham, describing them as “the best possible outcome for UK organisations processing personal data from the EU. This means that organisations can be confident in the free flow of personal data from 1 January, without having to make any changes to their data protection practices.”
However, the ICO continues to recommend that, during this grace period, businesses carry on working to identify any requirements to put in place alternative transfer mechanisms in respect of EU-UK data flows to protect against any disruption to the flow of UK-EU data, or in case the EU does not grant the UK an adequacy decision.
Businesses should also note that the interim arrangements set out in the UK-EU trade deal do not relieve organisations in either the UK or the EU of their obligation to appoint an authorised representative where they provide services to or monitor behaviour of individuals in the EU or UK respectively.