What does the provisional UK – EU trade agreement mean for personal data flows?

On 24 December 2020 it was announced that the United Kingdom ("UK") and European Union ("EU") had reached an agreement, in principle, outlining the basis for the ongoing relationship between the UK and EU once the Brexit transition period ends on 23:00 (GMT) 31 December 2020 ("Brexit Transition Period").

The agreement, entitled the EU-UK Trade and Cooperation Agreement (hereafter the "Trade Agreement"), contains a further transitional period of up to six months ("Additional Transition Period") during which personal data can flow freely between the European Economic Area ("EEA") and UK without the need for parties to implement additional safeguards to effect such transfers.

Beginning 1 January 2021, the UK will be considered a third country for purposes of the EU General Data Protection Regulation ("GDPR"). As a result, transfers of personal data from the EEA to the UK will be prohibited unless the European Commission has taken an adequacy decision or – in the absence thereof - EEA data exporters take further steps to ensure adequacy for personal data, such as entering into the EU Standard Contractual Clauses, implementing Binding Corporate Rules or relying on any of the available derogations in the GDPR.

The Trade Agreement states that during the Additional Transition Period transfers of personal data from the EEA to the UK will not be considered transfers of personal data to a third country, and as such, will not be prohibited by the GDPR. The purpose of the Additional Transition Period is to enable the European Commission to complete its adequacy assessment of the UK’s data protection laws.

The Trade Agreement will take provisional effect on 1 January 2021, but must be adopted by the European Council and consented to by the European Parliament before it can be ratified and fully implemented. The Trade Agreement will also need to be approved by the UK Parliament.

In response to the announcement, the UK Information Commissioner's Office ("ICO") released a statement on 28 December 2020. In its statement, the ICO recommends that UK organisations, both before and during the Additional Transition Period, work alongside EEA organisations from who they receive personal data to ensure adequate transfer mechanisms are in place to safeguard against possible future interruptions to data flows.

For more information on how the end of the Brexit Transition Period will impact data protection, see our recent alert here.