Personal Data Transfers to and from the EU after the Brexit Transition Period (Post Transition Update)

Note: This article updates our article of 19 December 2020 ‘Personal Data Transfers to and from the EU Post Brexit’.

Now that the United Kingdom (UK) has moved beyond the Brexit Transition Period, the European Union (EU) and the UK have adopted a ‘Trade and Cooperation Agreement’ along with information published by the UK Government and the Information Commissioner’s Office (ICO), we are in a better position to understand how and under what legal mechanism or mechanisms, the transfer of personal data across EU/EEA (European Economic Area) and UK borders will continue.

In principle, it appears that both parties, EU and UK, have agreed to maintain the current personal data transfer arrangements for a period of up to six months, whilst the EU assesses the ‘Adequacy’ position of the UK with regard to the Personal Data and Data Privacy. This means that the transfer of personal data between controllers and processors based within the EU/EEA and the UK, can continue as prior to the end of the Brexit transition period for the next six months.

At the end of that period, the EU will have completed their assessment of the laws, regulations, and mechanisms within the UK and assuming that there is no change from the current situation, then the UK will be granted the status of Adequacy. It is our view that the UK is unlikely to alter the situation over the next six months and therefore, the UK will be granted the status of Adequacy in July 2020. We will watch this situation.

However, we are aware that the UK government’s stated aim of Brexit is the establishment of ‘sovereignty’ over its laws and regulations and has expressed a desire to diverge a number laws and regulations from those that existed when a member of the EU. This means that we need to be aware that data protection laws may well diverge, and this could lead to the loss of Adequacy, and we will monitor this over time. If the UK loses the status of Adequacy, the information in our article of 19 December 2020 ‘Personal Data Transfers to and from the EU Post Brexit’ will likely apply.

If you wish to discuss your organisation’s specific situation, please use our Contact Us form.