Brexit: Transfer of personal data to the United Kingdom

Since 31 January 2020, the United Kingdom has not been a member of the EU, but due to the transition period agreed as part of the EU-UK agreement on Brexit, companies, authorities, and organisations established within the EU/EEA have been able to continue to transfer personal data to the UK as before. 

The transition period expired on 31 December 2020, but on 24 December 2020, the EU and the UK reached an agreement on a trade agreement which, among other things, provides for transfers of personal data from the EU to the UK.
 

THE IMPORTANCE OF THE TRADE AGREEMENT - THE NEW TRANSITION PERIOD

The trade agreement introduces a new transition period, which means, among other things, that transfers of personal data to the UK can continue to take place as if the UK were a member of the EU until the end of the new transition period. Therefore, the UK will not yet be considered a third country in terms of data protection law.

The solution regarding transfers of personal data to the UK will remain in force until the EU Commission decided on the adequacy of the level of protection (i.e., whether the UK has an adequate level of data protection in line with the GDPR). This must be decided by 1 May 2021, but the deadline will automatically be extended until 1 July 2021 if no decision has been taken on the adequacy of the level of protection in the UK and neither party otherwise objects to such an extension of the period. 
 

EXPIRY OF THE NEW TRANSITION PERIOD

If the adequacy decision is adopted before the end of the new transition period, the transfer of personal data to the UK will be considered a transfer to a secure third country under the GDPR. Therefore, personal data may be transferred under the same conditions as to EU countries.

If the EU Commission does not adopt the adequacy decision before the end of the new transition period, the UK will be considered an unsafe third country. In this case, the rules on the transfer of personal data to third countries in the GDPR must be observed. Lawful transfer to unsafe third countries may take place under Article 46. For example, this can be achieved by using:

1. The Standard Contractual Clauses of the European Commission (SCCs)
2. Binding company rules for affiliated companies

NJORD'S COMMENTS

At this stage, we are awaiting the EU Commission and whether they find that the UK has an adequate level of protection.

However, NJORD recommends that companies and authorities already ensure an overview of the transfers made to the UK and prepare for how transfers to the UK in the future can be made if the adequacy decision is not adopted before the end of the transition period or if the UK cannot be approved as a safe third country. 

Work may also begin on adapting registers and privacy policies with information on transfers of personal data to the UK, as the requirement to list third countries to which personal data is transferred will apply – even if the UK is approved as a safe third country.