The recent Brexit trade agreement reached by the UK government has provided good news for the future of EU-UK personal data transfers, essentially stating that personal data may flow freely between the UK and Europe after 31 December 2020.
The UK government announced recently that it has reached an agreement with the EU that will allow personal data to flow freely from the European Economic Area to the UK, until adequacy decisions have been adopted, for no more than six months. What this means practically is that for the time being personal data can freely flow, until the EU has made a decision on whether the UK can be deemed as ‘adequate’ (meaning it is deemed to offer an adequate level of data protection). This is welcome news, as it will allow organisations to continue to freely receive personal data from Europe post Brexit.
The UK Information Commissioner’s Office (the data protection regulator) has published a statement which nevertheless recommends that businesses work with EU and EEA organisations who transfer personal data to them, to put in place alternative transfer mechanisms to safeguard against any interruption to the free flow of EU to UK personal data.
Elizabeth Denham, Information Commissioner, welcomed the news by stating: “This is the best possible outcome for UK organisations processing personal data from the EU. This means that organisations can be confident in the free flow of personal data from 1 January, without having to make any changes to their data protection practices.”
The ICO has stated that it will be updating its guidance in order to provide businesses with information on the new arrangements. Businesses should continue to monitor the developments and the newly issued guidance. In addition to international transfers of personal data, businesses should take various practical steps to ensure that they are compliant with data protection laws post Brexit.
For advice on international data transfers and wider post Brexit data protection compliance issues, contact Mackrell. Solicitors.