U.K. Reaches an Interim Agreement with the European Union for Data Transfers Post-Brexit

On the eve of the expiration of the Brexit transitional period, the U.K. Government has reached an agreement with the European Union that will allow personal data to flow freely from the European Union and the European Economic Area to the U.K. after December 31, 2020.  The agreed-upon extension will run until adequacy decisions have been adopted, for no more than six months.

As the U.K. is no longer part of the EU, the EU’s General Data Protection Regulation requires that data transfers to the U.K. be conducted pursuant to an authorized data transfer mechanism.  An adequacy decision with a transferee country permits a cross-border data transfer to a party in that country.

This agreement will allow businesses and public bodies in the United Kingdom to continue to freely receive data from the EU and the EEA.  The U.K., in turn, has already deemed the EU and EEA States to be “adequate” to allow for data flows from the U.K.

The development is a welcome news for organizations within the United Kingdom and the European Union.  According to recent research, the cost of having to put in place alternative transfer mechanisms could have cost U.K. businesses £1.6 billion. Nevertheless, as a precaution, before and during the new transition period, the U.K.’s Information Commissioner’s Office recommends that the U.K. businesses work with the EU and EEA organizations who transfer personal data to them, to put in place alternative transfer mechanisms, to safeguard against any interruption to the free flow of E.U. to U.K. personal data.

The agreement paves the way for the U.K.’s adequacy decision. Eventually conferring an adequacy decision on the U.K. will require a proposal from the European Commission, an opinion from the European Data Protection Board, the approval by EU member states, as well as an adopting decision by the commissioners.

Improve customer trust with Clarip’s privacy governance platform.  Schedule a demo of the Clarip data mapping software for GDPR by calling 1-888-252-5653.