With the end of the Brexit transition period quickly approaching on 31 December 2020, the future of international data transfers between the UK and the European Union (EU) and European Economic Area (EEA) remains somewhat unclear.
As background, Article 44 of the General Data Protection Regulation (GDPR) prohibits the transfer of personal data from the EU/EEA to recipients in jurisdictions outside the EU/EEA, unless specific conditions are met. One such condition under the GDPR is an “adequacy decision” granted by the European Commission. If a third country is deemed adequate by the European Commission, the personal data can be transferred to that country without any additional safeguards being required.
After 31 December 2020, the UK will no longer be bound by the European Commissions’ decisions. As such, the UK has now rolled over 42 adequacy decisions, namely the 30 EU/EEA countries and the 12 countries that have received EU adequacy decisions (Andorra, Argentina, Canada (commercial organisations), the Faroe Islands, Guernsey, Israel, Isle of Man, Japan, New Zealand, Switzerland and Uruguay). This will ensure transfers from the UK to these 42 countries can continue as before. The majority of the 12 EU adequate countries (except Andorra) have also noted they will allow uninterrupted data transfers to the UK after 31 December 2020.
However, the big question remains. How will the EU/EEA treat the UK? Unless a Brexit deal which covers data protection and how data transfers between the EU and the UK are to be treated is reached, the UK will be treated as a third country for the purposes of international data transfers beginning 1 January 2021. It will then depend on the European Commission to decide on UK’s adequacy with respect to transfers from the EU/EEA to the UK, or otherwise data exporters will need to consider appropriate transfer mechanisms, such as the standard contractual clauses, and conduct data transfer impact assessments as a result of the Schrems II decision, which we previously discussed here.
In the meantime, the UK is now preparing to start its own adequacy decisions next year. Keep an eye on our blog for further updates!