On Dec. 24, 2020, the European Union and the United Kingdom ("UK") agreed on the "UK-EU Trade and Cooperation Agreement" ("Trade Agreement"), which entered into force on Jan. 1. So it's high time to take stock: almost a year after Brexit, where does the transfer of personal data to companies in the UK stand?
By Remi van Mansfeld and Elze 't Hart.
Since Feb. 1, 2020, the UK is no longer a member of the EU. Under the EU-UK withdrawal agreement, personal data could still be freely shared with organizations in the UK. However, as of Jan. 1, 2021, this agreement ended. As a result, at the end of last year, there was some anxiety as to whether personal data could still be freely shared with the UK in 2021 under the General Data Protection Regulation ("AVG"). This is because the AVG sets strict conditions for the transfer of personal data to countries outside the EU. For example, personal data may be transferred if the European Commission has decided that a country ensures an adequate level of protection for the personal data ('Adequacy Decision'). However, an Adequacy Decision has not (yet) been made for the UK. This means that the exchange of personal data is only possible if appropriate safeguards are in place. Appropriate safeguards may include, for example, the conclusion of European Commission model agreements ('Model Agreement') with the UK organization or transfer between group entities under binding corporate rules ('BCRs'). This means that following the expiration of the EU-UK Withdrawal Agreement with no UK-EU deal, organizations would no longer be able to transfer personal data if they do not put in place further appropriate safeguards, such as entering into the agreements mentioned above. Only for occasional transfers in specific situations do exceptions exist under the AVG.
Under the new Trade Agreement, the UK is not yet considered a "third country" for the purposes of the AVG, which means that personal data may still be transferred to (companies in) the UK until an Adequacy Decision has been taken by the European Commission or the expiry of four months, whichever comes first. The four-month period is automatically extended by two months unless the EU or the UK objects. Practically, therefore, the Trade Agreement appears to extend the pre-2021 situation by six months, through June 30, 2021.
The effect of the Trade Agreement is that for the next four (and probably six) months organizations will be allowed to transfer personal data to (organizations in) the UK without the imposition of further safeguards. Moreover, it is expected that an Adequacy Decision will be issued by June 30, 2021, so little will change for companies after this date as well. However, if an Adequacy Decision does not follow in time, appropriate safeguards will still need to be put in place by organizations. In that context, it is advisable to take such a situation into account now when entering into agreements and to make appropriate safeguards.
Of course, we are closely monitoring developments and are available to answer questions about, or assist in contracting with, parties that transfer personal data to the UK.
