How Brexit has impacted on data protection transfers
Table of Contents:
1. Background facts
2. Outbound flow of personal data
3. The Trade Deal
4. What’s next
1. Background facts
The UK left the EU on 31st January 2020 on the basis of the Withdrawal Agreement. A transitional period, during which EU law continued to apply in the UK, ended on 31st December 2020, meaning that on such date the UK became a “third country” from the EU perspective. What is the impact on data protection rules in Ireland (as an EU Member State)?
2. Outbound flow of personal data
Firstly, as of the end of the transition period, the transfer of personal data from Ireland to the UK is treated in the same way as transfers of personal data to other countries outside the EU or EEA.
However, as of the end of the transition period, UK accepted that the UK personal data can flow to EU or EEA countries without the need for any additional protection, while the EU made a different choice.
Indeed, personal data can be transferred outside EU/EEA only where (i) the transfer is to a country which has the benefit of an Adequacy Decision from the European Commission or (ii) the country to which the data is transferred, has put in place adequate safeguards as set out in the GDPR (General Data Protection Regulation).
An Adequacy Decision is an approval by the European Commission that the country in question (in this case the UK) ensures an adequate level of data protection, thereby allowing personal data to be sent from an EU or an EEA state to that country without further safeguards.
3. The Trade Deal
On 31st December 2020, the EU and the UK signed a Trade and Cooperation Agreement (Trade Deal) which deals with every aspect of the trade relationship between the UK and the EU, such as, judicial cooperation, transport, social security and cybersecurity.
The Trade Deal provides that personal data can be transferred from the EU/EEA to the UK for up to 6 months after 1st January 2021 or until an Adequacy Decision is adopted, whichever is earlier (the Specified Period), provided that (a) the UK does not amend the data protection legislation in place as of 31st December 2020, and (b) it does not exercise specified dedicated powers, including approving new Standard Contractual Clauses or Binding Corporate Rules (see par. 4 below), unless the EU approves of them.
Therefore, for the duration of the Specified Period, the transfer of personal data from the EU to the UK will not be considered a transfer to a “third country”.
4. What’s next
However, on 19th February 2021, the European Commission launched the process for the adoption of two Adequacy Decisions for the transfer of personal data to the UK, one under the GDPR and the other under the Law Enforcement Directive (transposed in Ireland by part 5 of the Data Protection Act 2018). The Law Enforcement Directive is a piece of EU legislation parallel to the GDPR – this regime applies in case the data controller is an authority (such as the Gardaí, the Irish police) and the processing is carried out for law enforcement purposes.
In the event the two adequacy decisions are adopted, they are going to last for 4 years, provided that the European Commission will monitor, on an ongoing basis, relevant developments in the UK to assess it still ensures an equivalent level of protection.
However, if the adequacy decisions are not approved by 30th June 2021, alternative transfer mechanisms to safeguard against any interruption of the free flow of personal data to the UK will have to be put in place immediately.
These safeguards will include the use of (i) Standard Contractual Clauses (they are approved by the EU and can be incorporated into or signed as a separate contract), or (ii) Binding Corporate Rules, used by many multinationals as a method to achieve intra-group international data transfers in compliance with the GDPR rules – these rules provide (a) a rigorous approval process, and (b) a supervision by a supervisory authority, such as, in Ireland, the Data Protection Commission.
