Six more months of UK-EEA free flow of Data
“This is the best possible outcome for UK organisations processing personal data from the EU” stated Information Commissioner, Elizabeth Denham.
The Commissioner was reacting to confirmation, included in the UK-EU Trade and Cooperation Agreement (the “Agreement”), that the EU will continue to allow personal data to flow freely between the European Economic Area and the UK. This will come as a great relief to many organisations with European offices or parties to UK-EU relationships that require the free and uninterrupted flow of personal data.
There is, however, one key caveat. This temporary allowance for the free flow of data will only continue for a maximum period of 6 months (4 months from the date of the agreement with the option to extend for a further two unless one party objects) or until the UK is granted an adequacy decision by the European Union.
In short, an adequacy decision is a safeguarding mechanism issued by the European Commission to countries outside of the European Economic Area. The decision acts as a means of certification that the awarded country has the appropriate level of personal data protection in place; a level of protection that must be similar to the protections outlined in the EU’s General Data Protection Regulations (the “GDPR”).
Whether or not an adequacy decision will be granted is by no means guaranteed. It had been previously hoped that even if the UK was not granted an adequacy decision, organisations could rely on Standard Contractual Clauses to facilitate the transfer. However, the decision in Schrems II has emphasized that these may not be suitable unless onward transfers of personal data are also adequately protected. The US, amongst other countries, is known to have more controversial local surveillance laws and it would appear that the EU remains very concerned about the extent to which a country’s law enforcement and public authorities can access a resident’s data.
The Agreement also stipulated that the UK will not change its current data protection laws, from those in circulation as at 31 December 2020, during the 6 month period. However, changes may come after once this period has lapsed; we would advise all organizations to continue to keep abreast of any further announcements by the ICO.
Read the ICO’s full statement