Alliance: The EU-UK agreement on data transfer

The trade and cooperation agreement

The most important provision of the TCA regarding data protection sets out that personal data may be transferred from the EU to the UK with no further guarantees for a period of four months (the bridge) from the end of the transitional period, that is from 1 January 2021. It was also agreed that this temporary period will be automatically extended by a further period of two months unless either the EU or the UK declares otherwise.

Adequacy decision

An adequacy decision is a formal decision made by the EU Commission, in accordance with Article 45 of the GDPR, which recognises that another country provides an equivalent level of protection for personal data as laid down in the GDPR. The UK is currently seeking an adequacy decision under GDPR. The effect of an adequacy decision is that personal data can flow from the EU (and Norway, Liechtenstein and Iceland) to the third country without any further safeguard being necessary. The abovementioned bridge period will end earlier if, in the meantime, the EU Commission adopts an adequacy decision.

Alternative solutions

The UK data protection authority, the Information Commissioner’s Office, pointed out

that during this bridge period businesses need to be prepared to develop alternative data transfer mechanisms for the event that no adequacy decision will be made until the end of the bridge period. Other data transfer mechanisms which offer alternative solutions to comply with the GDPR are set out in Articles 46-50 of the GDPR. These rules govern any data transfers into third countries (countries outside the EEA) from the EEA. From 1 January 2021, the UK qualifies as a third country, though the application of the relevant rules is delayed during the bridge period.

Further cooperation

The EU and the UK also agreed to cooperate on data protection matters both at bilateral and multilateral levels through the exchange of experience and fight against crime. Regarding the location of data storage, the parties agreed that none of them will require that personal data is stored or processed in their territory.



Autor: Michael M. Pachinger