+44 (0)20 7404 0606
Trade & Cooperation Agreement - what does it mean for Data Protection?
- AuthorPaul Herbert
Following the long awaited, and very last minute, Trade and Cooperation Agreement put in place between the UK and the EU on Christmas Eve we summarise the headlines concerning data transfers as from January 2021:
Transfers from UK to EEA
These will remain subject to the UK’s GDPR (which is more or less identical in substance to the EU’s GDPR). The UK has confirmed that such transfers are not restricted and so can continue as before without the need for any transfer mechanisms to be put in place.
Transfers from UK to third countries outside the EEA
The position remains similar to the current GDPR rules. Although the UK will in due course make its own adequacy decisions, for the time being existing EU adequacy decisions apply and the EU approved standard contractual clauses (SCCs) can continue to be used where there is no finding of adequacy.
Transfers from EEA to UK
This was the key potential sticking point: From January 2021 the UK is a “third country” so far as the EU’s GDPR is concerned; therefore, transfers from the EEA to the UK would be restricted transfers. The UK had been seeking an adequacy decision from the European Commission as part of the Brexit deal to permit such transfers to continue without the need for a transfer tool to be put in place. A joint declaration published alongside the TCA made clear that the EU would undertake this adequacy assessment, albeit that this was not part of the Brexit deal. Pending this, a temporary arrangement was agreed to allow data to continue to be transferred from the EEA to the UK for the next four months (extendable to six months).
The good news is that on 19 February 2021, the EC published a press release stating that it had carefully assessed the UK's law and practice on personal data protection and concluded that the UK does ensure an "essentially equivalent" level of protection to that guaranteed under the EU GDPR. This finding is presently in draft form as it has to be submitted to the European Data Protection Board for a "non-binding opinion". The EC will then request approval from EU member states' representatives before formally adopting this adequacy decision. That should all be a formality but until then the temporary bridging mechanism continues to apply.
If adopted, the decision will be valid for an initial term of four years, only renewable if the level of protection in the UK continues to be adequate. The draft adequacy decision includes strict mechanisms for monitoring and review, suspension or withdrawal, to address any problematic future development of the UK’s laws so as to no longer be bound by EU privacy rules.
The UK government has welcomed the draft (whilst critical of the delay in issuing it), urging the EU to complete the approval process swiftly.
A source of massive potential friction to data transfers has been avoided.
If you would like further advice about your commercial contracts and the end of the transition period then please contact Paul Herbert, Partner and head of the Commercial team at Goodman Derrick at email@example.com or on +44 (0)20 7421 7922.
This guide is for general information only and should not be relied upon as providing specific legal advice.
UK-EU - Trade and Cooperation - Legal Services from Goodman Derrick
The Brexit transition period has ended and the UK Government and the European Commission has announced the terms of our new trading relationship in the draft Trade & Cooperation Agreement (TCA).
The TCA is wide-ranging and includes terms on trade in goods and services, economic and social co-operation, law enforcement and security co-operation and governance.
There is now no doubt that the UK’s relationship with the EU has changed for good, there will be both new legal risks and commercial opportunities for your business in the months and years ahead – is your business ready?