In a year that saw the use of US-EU Privacy Shield invalidated and the qualified survival of the heavily-utilised Standard Contractual Clauses as well as the release of new draft Standard Contractual Clauses, 2020 certainly packed a punch on the issue of international data transfers. 

This was against the backdrop of the expiration of the UK-EU transition period which, if left unaddressed, would have meant that the UK would be treated as third country for the purposes of GDPR. No one was quite sure what was going to happen but we predicted in our November opinion piece (which can be accessed here) that the provision of an adequacy decision, the preferred option, would take longer and that an extension to the transition period to deal with personal data transfers was the most likely option in the meantime. 

The UK-EU Trade and Co-operation Agreement (Trade Agreement) agreed at the eleventh hour on Christmas Eve provided a temporary preservation of the current position pending a decision by the European Commission. As predicted, an adequacy decision was not granted as part of the Trade Agreement.  Instead,  the continuation of the status quo for a temporary period of up to six  months (Temporary Period) was agreed, allowing data transfers to continue for this period without additional safeguards.  This is subject to the UK not deviating from data protection laws in place in the UK as at 31 December 2020 or exercising certain powers relating to international transfers without the EU’s agreement. During the Temporary Period, transmissions from the EEA to the UK are not considered to be transfers to a third country under EU law. 

Adequacy – no guarantees

Reciprocal EU and UK adequacy decisions enshrining GDPR will be the optimal outcome and it is reasonable to regard the securing of this outcome as the motivation behind the Temporary Period. The UK has announced that it will initially treat EEA countries as adequate for the purposes of UK to EEA transfers and will keep this under review. 

An EU adequacy decision in favour of the UK is arguably a more complicated issue. It cannot be assumed, as mentioned in our November opinion piece (access here), that an adequacy decision is a fait accompli. The UK’s existing regime on the retention and transmission of bulk personal data for national security purposes, for example, is cause for concern for the EU. Recent CJEU caselaw involving the UK, and France and Belgium, highlight the ongoing tension between EU data protection laws and national security laws. That being said, the GDPR is reflected in UK data protection law via the Withdrawal Act 2018, the Data Protection Act 2018 and the UK GDPR. In view of this alignment and the political and commercial risks, there is reason to be cautiously optimistic that an EU adequacy decision will be forthcoming before the end of the Temporary Period. This could be advanced significantly if the UK Government is prepared to modify some of its surveillance laws.

If you require any advice on these issues or are uncertain if they apply to you and your organisation, please contact John O’Connor, Maggie O’Leary or your usual William Fry contact. 

Contributed by Maggie O’Leary