On December 25th 2020, European Commission published a trade relations agreement between the European Union (hereinafter – EU) and the United Kingdom (hereinafter – UK). Among other aspects, the document sets out the temporary provisions for the transfer of personal data to the UK.
Aspects defined in the agreement:
- The transfer of personal data from the EU to the UK shall not be considered as a transfer of data to a third country for the period of 6 months, starting from January 1st, 2021
What does it mean: Entities transferring personal data to the UK will not be required to take additional safeguarding measures to ensure the continuous data protection standard application, after the data transfer to third countries. Therefore, the transfer of personal data to the UK will not be subject to the provisions of Chapter V of the GDPR, which means that for the next 6 months, the transfer of data to the UK shall be considered as a transfer of data within the EU.
- A period of 6 months to adopt an Adequacy Decision
What does it mean: The transfer of personal data from the EU to the UK from January 1st may continue in the same methods and ways as been the case so far – UK will comply with the internal personal data legislation in force arising from the GDPR and any of the regulations shall not be changed without the EU consent. However, the most important aspect is that we should receive the European Commission’s Adequacy Decision for the UK – a legal act, confirming that the UK shall be considered as a third country that has an adequate level of data protection, in which case there will be no additional data safeguarding requirements from the entity that is transferring the data to the UK.
What measures should be taken if personal data is being transferred to the UK?
The UK supervisory authority of personal data (Information Commissioner’s Office) recommends the companies that transfers the personal data to the UK, to use this term of 6 months meaningfully by establishing the alternative data transfer mechanisms inside of their companies.
The text of the agreement on trade relations under Brexit can be found here (aspects of the personal data transfer to the UK are disclosed from the page 414).
For more information or consultation on data protection, please consult the specialists of ECOVIS ProventusLaw.
Prepared by Associate Andrius Karmonas