What does the “transitional” period for personal data transfers from the EU to the UK mean for business?
In the light of Brexit, from 1 January 2021, the Trade and Cooperation Agreement (the “Agreement”) between the EU and the UK dated 24 December 2020 came into force. The Agreement includes, inter alia, provisions regarding transfers of personal data.
For a six-month period (until 30 June 2021), a transfer of personal data from the EU to the UK will not be considered a transfer to a third country within the meaning of the provisions of the GDPR that allow such a transfer only if certain requirements are met or if the European Commission recognizes the country in question as providing an adequate level of personal data protection.
The Agreement includes several common measures for the protection of data and of confidentiality, in the form of obligations of the EU and the UK not to undertake actions to limit cross-border flows between the EU and the UK, and not to establish requirements for data localization.
The half-year period mentioned above is a “transitional” period, when the flow of personal data from the EU to UK is not restricted.
Before the end of this period, the European Commission is required to make a decision on the adequacy of personal data protection in the UK. Therefore, the UK may amend its local laws in an appropriate way subject to the EU’s prior approval.
As soon as the “transitional” period is complete, a transfer of personal data from the EU to the UK will be recognized as a transfer of personal data to a third country.
Hence, companies may transfer personal data from the EU to the UK without taking any additional measures to protect such data. However, there is uncertainty related to the potential breach of the free flow of personal data flow to the UK if the European Commission does not make a decision allowing data to be transferred freely from the EU to the UK.