Brexit Trade Agreement - Data Protection Grace Period
Posted on 6th January 2021 at 12:09
Over the Christmas period while many of us were distracted with socially distanced festivities, details of the Trade and Cooperation Agreement (“Trade Agreement”) between the UK and European Union were released.
From a data protection perspective, the situation is more positive than the pre-Christmas uncertainty, when it looked like there was a real possibility of the UK becoming a third country for the purposes of EU-to-UK personal data transfers. The Trade Agreement “confirms strong data protection commitments by both the UK and the EU, protecting consumers and helping to promote trust in the digital economy”.
What was agreed in the Trade Agreement is that there will be a grace period in respect of personal data transfers between the UK & EEA for an initial period of 4 months from 1 January 2021. This period will be extended by two further months unless either the EU or UK objects and, allows time for the UK to work towards obtaining an adequacy decision from the EU.
What does this mean for UK-EEA personal data transfers?
It means that all personal data transfers between the UK and EEA during this period can continue (provided appropriate data protection agreements are currently in place) and that there is no need to rush to put in place alternative measures such as a data protection agreement containing standard contractual clauses.
However, the adequacy decision is not guaranteed, and additional measures may ultimately be required if an adequacy decision from the EU is not forthcoming within the grace period. However, the Trade Agreement does seem to indicate intent to progress a speedy adequacy decision by both the UK and EU.
It is worth noting that the grace period does not negate the requirement to have an EU representative. If you are based in the UK and do not have a branch, office or other establishment in any other EEA state, but you either:
• offer is likely to receive a goods or services to individuals in the EEA; or
• monitor the behaviour of individuals in the EEA.
This grace period will be most welcome by many UK and EEA businesses and seems to be a positive signal that the UK may receive a decision of adequacy quickly.
This briefing is for general guidance only and should not be regarded as a substitute for professional advice. Such advice should always be taken before acting on any of the matters discussed.
Tagged as: Brexit, Data Protection
Share this post: