On 24 December 2020 it was announced that the United Kingdom ("UK") and European Union ("EU") had reached an agreement, in principle, outlining the basis for the ongoing relationship between the UK and EU once the Brexit transition period ends on 23:00 (GMT) 31 December 2020 ("Brexit Transition Period").
The agreement, entitled the EU-UK Trade and Cooperation Agreement (hereafter the "Trade Agreement"), contains a further transitional period of up to six months ("Additional Transition Period") during which personal data can flow freely between the European Economic Area ("EEA") and UK without the need for parties to implement additional safeguards to effect such transfers.
Beginning 1 January 2021, the UK will be considered a third country for purposes of the EU General Data Protection Regulation ("GDPR"). As a result, transfers of personal data from the EEA to the UK will be prohibited unless the European Commission has taken an adequacy decision or – in the absence thereof - EEA data exporters take further steps to ensure adequacy for personal data, such as entering into the EU Standard Contractual Clauses, implementing Binding Corporate Rules or relying on any of the available derogations in the GDPR.
The Trade Agreement states that during the Additional Transition Period transfers of personal data from the EEA to the UK will not be considered transfers of personal data to a third country, and as such, will not be prohibited by the GDPR. The purpose of the Additional Transition Period is to enable the European Commission to complete its adequacy assessment of the UK's data protection laws.
The Trade Agreement will take provisional effect on 1 January 2021, but must be adopted by the European Council and consented to by the European Parliament before it can be ratified and fully implemented. The Trade Agreement will also need to be approved by the UK Parliament.
In response to the announcement, the UK Information Commissioner's Office ("ICO") released a statement on 28 December 2020. In its statement, the ICO recommends that UK organisations, both before and during the Additional Transition Period, work alongside EEA organisations from who they receive personal data to ensure adequate transfer mechanisms are in place to safeguard against possible future interruptions to data flows.
Visit us at mayerbrown.com
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2020. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.