Positive steps towards personal data transfers between the UK and EU

Brexit has complicated exchanges of personal information between European and domestic businesses. Until otherwise decided, the UK is now classed as a ‘third country,’ not explicitly covered under EU GDPR, thereby requiring extra steps to be taken to protect personal data flowing from the EU. Considering the significance of efficiency in choosing data processing partners on both ends, this would threaten seamless EU-UK business and make commercial exchanges increasingly difficult. Fortunately, positive reassurance has recently been offered by the EU, which has drafted an ‘adequacy decision’ in the UK’s favour, that could resolve the problem.

The current Brexit transition arrangement assures a 6 month bridging arrangement which means that data restrictions will not be imposed until, at least, the 30th June 2021 (See Lawspeed article). Following this, an adequacy decision would be required to determine that the UK applies adequate safeguards which even America has not yet fully achieved. Acknowledging this, the UK GDPR was passed on 1st January 2021 to keep UK data protection in line with our EU counterparts, increasing the likelihood of an adequacy decision being passed.

Signals about the future of EU-UK data transfers from the EU’s draft adequacy decision

The EC’s recent press release concludes that a thorough examination of the UK’s data protection legislation has been conducted. This finds that the UK’s protections are “essentially equivalent” to the EU’s. The verdict is highly promising for businesses on both ends because, once finalised, it assures that data transfers will not be subject to the additional scrutiny placed on data transfers to businesses in other countries. UK-EU businesses could continue to freely exchange data! An adequacy ruling of this sort would also guarantee protections for 4 years (continued as long as the UK continues to provide adequate data protection rights.)

Associate Director (Lawspeed), Theresa Mimnagh said

“An adequacy decision is a logical step, given that the UK operates to the same data protection standards as the EU. It will be helpful for all recruitment businesses engaging with EU based clients, or candidates, allowing the seamless transfer of data without the need for additional contractual terms. Businesses engaging with clients outside of the EU must still ensure that appropriate safeguards are in place – We now await conformation that the decision has been endorsed and finalised.”