Interim deal reached on cross-border transfers of personal data

The UK and EU have committed as part of the EU-UK Trade and Cooperation Agreement to ensure cross-border personal data flows.

Consultants and contractors will be reassured that until 1 July 2021 transfers of personal data from the EU to the UK will be permitted and not treated as transfers of data from the EU to a third country. This bridging solution effectively extends the current transition period, subject to the UK not making material changes to its existing data protection laws. In addition, the UK has, on a transitional basis, deemed EU member states to be adequate for data flows from the UK.

The EU and UK are now working on making findings of adequacy in relation to each other’s data protection regimes. This should be straightforward from the UK’s perspective in relation to the EU, but the EU has said that the Trade and Cooperation Agreement does not guarantee a finding of adequacy. It remains a unilateral decision of the EU and is not subject to negotiation.

An adequacy decision is a finding of the European Commission under Article 45 of the GDPR that a third country has an adequate level of data protection. The effect of an adequacy decision is that personal data can be sent from a member state to a third country without any further safeguards being necessary. The European Commission has so far recognised Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay as providing adequate protection.

James Hutchinson, a Partner specialising in data protection at Beale & Co, said:

“Consultants and contractors will be relieved that at least one New Year’s resolution has been achieved – to ensure cross-border transfers of personal data are compliant with both EU and UK law.

On 1 January 2021, the UK was to become a third country. The GDPR restricts transfers of personal data to third countries, so this would have had significant consequences for anyone transferring personal data from the EU to the UK.

Cross-border data flows are vital to the construction sector, whether arising from an international project or a transfer of employee information within a group. This four to six-month transition period should hopefully provide the EU with sufficient time to make a finding of adequacy of the UK’s data protection regime. However, until a finding is made, there remains a risk that we will be back looking at what safeguards can be put in place to permit EU to UK data transfers.”

The full text of the Trade and Cooperation Agreement is available here and the relevant sections are attached to this note.

For further information, please contact James Hutchinson at j.hutchinson@beale-law.com or on +44 (0) 20 7469 0408.