Tuesday, December 22, 2020
The UK is nearing the top of its Brexit transition interval (the Transition Interval), which expires Dec. 31, 2020. Though the UK has not been a celebration to the European Financial Space (EEA) settlement for the reason that passage of Brexit, it has been handled as an EEA member through the Transition Interval. Due to this standing, information has continued to circulate freely between the EU and UK throughout this time. Nevertheless, the UK’s therapy as a member of the EEA is ready to finish upon the expiration of the Transition Interval. At that time the UK might be thought of a “third nation” underneath the GDPR for the aim of cross-border information transfers. Corporations within the EEA could solely freely switch information to a 3rd nation if the European Fee has granted an adequacy determination for the nation. In any other case, the corporate should take steps to make sure that the importing nation (i.e., the UK) gives protections equal to these within the EEA.
As of mid-December 2020, the European Fee has not granted an adequacy determination to the UK. It’s potential that no adequacy determination might be delivered in time to permit a easy transition for information circulate on the finish of the Transition Interval. UK and EU officers are at the moment discussing a short lived extension (now not than six months), however this interim answer is tied to wider commerce negotiations, the efficacy of which has remained unsure. Additional, any extension to the information circulate that’s granted could also be instantly challenged by privateness advocates in EU courts.
Will information transfers from the UK to the EEA be affected?
No (for now). Underneath the UK’s home model of the GDPR, which comes into impact Jan. 1, 2021, on the similar time the EU GDPR ceases its applicability within the UK, information could proceed to circulate freely from the UK to the EEA after the top of the Transition Interval. The UK’s Data Commissioner’s Workplace (ICO) has issued official steering that signifies that transfers out of the UK to the EEA will stay unaffected in the intervening time, no matter what occurs on the finish of the Transition Interval. Nevertheless, the UK has acknowledged that it intends to maintain this association “underneath overview.”
Will international locations which were deemed enough by the EU proceed to permit uninterrupted information transfers to the UK?
Principally sure. The EU has delivered adequacy selections for Andorra, Argentina, Canada, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, Switzerland and Uruguay. The UK authorities has entered into particular preparations with all of the international locations/territories listed above (besides Andorra) to permit for the continued uninterrupted circulate of knowledge into the UK. That implies that information collected in one in all these international locations is prone to proceed to circulate to the UK uninterrupted. You will need to word, nevertheless, that if information from the EEA is collected in one in all these international locations, an organization could not really feel snug transferring that information to the UK (an “onward switch”) with out further steps to make sure that the enough protections are in place to make the UK enough. Put otherwise, information that originates in one in all these international locations will circulate uninterrupted to the UK. Information that originated within the EEA, and passes via one in all these international locations, might have further steps earlier than it could go to the UK.
Will the UK proceed to honor the European Fee’s present adequacy selections?
Sure. The ICO’s steering for giant enterprise gives that the UK authorities intends to recognise EU Fee adequacy selections made earlier than the top of the transition interval. This can permit restricted transfers to proceed to be created from the UK to most organizations, international locations, territories, or sectors coated by an EU adequacy determination.
Affect on firms
If your organization often transfers information from the EEA to the UK, you ought to be ready to shortly adapt if no adequacy determination or short-term extension of the UK’s present standing is delivered by Dec. 31, 2020. This implies ensuring that your organization is ready to implement an accepted switch mechanism (such because the SCCs together with applicable supplemental measures, that are additionally in flux for the time being) as quickly as potential to cowl information transfers to distributors, enterprise companions and UK-based associates. It’s vital to be conscious of any particular steering issued within the coming weeks by EEA supervisory authorities on using explicit switch mechanisms for transfers to the UK. For instance, Eire’s Information Safety Fee (DPC) not too long ago acknowledged that firms might want to self-evaluate whether or not using the SCCs will supply equal safety to information transferred to the UK as that provided within the EEA, and will have to report sure UK transfers underneath the SCCs to the DPC.
Additional, you may additionally be required to replace your organization’s privateness notices to replicate how the corporate is dealing with information transfers to and from the UK, as the prevailing coverage could inaccurately state or omit required data regarding information switch mechanisms.
Lastly, no matter whether or not a choice is delivered in time or an extension is granted, if your organization is UK-based (or established wherever outdoors of the EEA), additionally, you will want to guage whether or not you might be obligated to nominate an EU consultant to behave as a contract level inside the EU.
The enforcement dangers for noncompliance through the interval instantly following expiration of the Transition Interval are anticipated to be low however will grow to be urgent as time goes on if the UK doesn’t shortly obtain an affirmative adequacy determination, or if the European Fee determines the UK isn’t enough. Notably, the choices of the Court docket of Justice of the European Union this yr (Schrems II being only one instance) point out that the UK will not be deemed enough. If that’s the case, even when UK and EU officers attain a deal for a short lived extension of the UK’s present standing, the deal could not present various months’ respite earlier than adjustments will have to be applied.
©2020 Greenberg Traurig, LLP. All rights reserved. Nationwide Regulation Overview, Quantity X, Quantity 357