In a positive development for multinational businesses, the Brexit Trade and Cooperation Agreement provides a temporary solution to allow the continued transfer of personal data from the EEA to the UK without the need for additional compliance measures, while the European Commission considers an adequacy decision in respect of the UK.
The Trade and Cooperation Agreement provisionally agreed between the UK and the EU runs to over 1,200 pages and covers a vast number of topics. One crucial question for many businesses that operate in both the European Economic Area ("EEA") and the UK had been whether cross-border transfers of personal data would be subject to new restrictions. Chapter V of the GDPR prohibits the transfer of personal data from the EEA to a "third country" (i.e., a country outside the EEA) unless certain additional protections are put in place, and it had been feared that businesses would need to implement such protections on short notice. That question has now been resolved, at least in the short term.
EEA to UK data transfers
Under the UK-EU Withdrawal Agreement, the UK became a "third country" on 1 February 2020, but continued to be treated as an EU Member State for certain purposes (including cross-border data transfers) during the "transition period". The transition period ends on 31 December 2020. After that date, transfers of personal data from the EEA to the UK would (absent the Trade and Cooperation Agreement) be subject to the same restrictions that currently apply to transfers of personal data from the EEA to the US, or any other third country that does not have an adequacy decision.
Before the Trade and Cooperation Agreement was announced, many businesses had been concerned that they would be required to implement additional compliance measures (such as Standard Contractual Clauses) in order to allow personal data to continue to flow from the EEA to the UK once the transition period ends. However, FINPROV.10A of the Trade and Cooperation Agreement alleviates this fear by providing that transfers of personal data from the EEA to the UK are not treated as transfers to a "third country" until the earlier of:
(a) the date on which the European Commission issues an adequacy decision regarding the UK; or
(b) 1 May 2021 (which will automatically be extended to 1 July 2021 unless either side objects).
This is significant because it means that businesses can continue to transfer personal data from the EEA to the UK for at least the next 4-6 months without additional compliance measures. It also suggests that the European Commission is sufficiently close to reaching an adequacy decision, in relation to the UK, that 4-6 months will be sufficient time to allow that adequacy decision to be finalised. However, there is still no guarantee that such an adequacy decision will be reached.
UK to EEA data transfers
With effect from the end of the transition period, the UK has effectively transposed the GDPR into the laws that apply in the UK (the "UK GDPR"). This includes an equivalent set of restrictions on transfers of personal data from the UK to any jurisdiction outside the UK. However, the UK GDPR treats all EEA jurisdictions, and all jurisdictions with an existing adequacy decision form the European Commission, as adequate. Accordingly, transfers of personal data from the UK to the EEA are largely unaffected by the end of the transition period.
Impact on businesses
Faced with significant uncertainty in the run-up to the end of the transition period, some businesses had already taken steps to put in place data transfer mechanisms such as Standard Contractual Clauses, on the assumption that there might not be a trade agreement between the EU and the UK (or that any such agreement might not cover cross-border data transfers). For those businesses, the news that the Trade and Cooperation Agreement addresses these issues has come too late. However, in the event that the European Commission does not grant the UK an adequacy decision within the timeframes set out above, any transfer mechanisms that have already been implemented may still prove useful.
The good news for businesses is that transfers of personal data from the EEA to the UK can continue, at least for the next 4-6 months. Whether that arrangement will become permanent, under an adequacy decision, is not yet clear.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2020 White & Case LLP
