The EU-UK Trade and Cooperation Agreement has brought an important – and helpful – development in data protection, specifically in relation to transfers of personal data between the EEA and the UK.
The EU-UK Trade and Cooperation Agreement (the ‘agreement’) allows for personal data to continue to flow freely from the EU to the UK, while an “adequacy decision” is reached (which confirms that the UK has adequate arrangements in place to protect data). In short, the agreement provides that, for a specified period (see below) and on condition that the UK’s current data protection regime stays in place, all transfers of personal data between EU and UK organisations will not be considered as transfers to a third country. The result is that they will not be subject to restrictions which would otherwise apply under Chapter V of the GDPR.
This interim provision applies from the entry into force of the Agreement for a maximum period of six months (i.e., until 30 June 2021 at the latest). It allows organisations in the EEA to carry on transferring data to UK organisations without the need to: either
- put in place a transfer tool under Article 46 of the EU GDPR; or
- rely on a derogation under Article 49 of the EU GDPR.
This is clearly the best possible (short-term) outcome for UK organisations in the absence of an adequacy decision.
Other changes to data protection law post-Brexit discussed in our previous article (i.e. the entry into force of the UK GDPR and the need to update data protection documentation, potential requirement to appoint a representative in the EU and the extraterritorial application of the EU GDPR to UK organisations with certain links to the EU) remain unaffected by the agreement and UK organisations need to take steps to comply with these requirements.
For further guidance, please contact our Information Law team.