At 11pm on 31st December, the Brexit transition period came to an end. Shortly before this, on 24th December, the UK Government and the EU Commission announced that a deal had been reached on the future of the EU-UK relationship.

In our last update, we looked at some of the uncertainty around data transfers between the UK and the European Economic Area (EEA) following the end of the transition period. Particularly we highlighted the lack of an adequacy decision confirming that it considers the UK to be a safe destination for personal data under the General Data Protection Regulations.

There was a concern that, without such a decision, another legal basis for transferring data from the EU to the UK would need to be found.

Whilst this position hasn’t changed, in that an adequacy decision has not been made, the EU-UK Trade and Cooperation Agreement (TCA) does contain some good news for those transferring data between the EEA and the UK.

The TCA sets out that the UK will now not be treated as a third country for the purposes of transfers of personal data from the EU (or EEA states that notify acceptance of the arrangement) to the UK until 1 July 2021, unless one of the parties notifies the other that it wants the period to end earlier on 1 May 2021.

This is significant because:

  • in the absence of the extension (and an adequacy decision), transfers of personal data from the EEA to UK would only have been permitted if appropriate safeguards (such as standard contractual clauses or BCRs) had been put in place or if specific (limited) derogations could be relied on
  • it raises the hope that an adequacy decision will be granted by the EU—something that has been in some doubt

There are some conditions to this, one of which being that the UK will be prohibited from making any changes to the current UK GDPR regime other than those which further align it to EU data protection law.

This is also good news as it shows commitment from both the UK and the EU to high standards of data protection. It also suggests that data protection law is unlikely to change in the UK in the immediate future.

If you have any questions or would like to discuss this, or any other matter, you can contact us at [email protected]