Data Protection and the UK/EU trade deal
With time running out, the EU/UK eventually announced that they had reached an agreement on trade following the UK exit from the European Union. With parliamentary approval expected and the EU already confirming provisional approval of the deal, the focus has turned on the actual detail of the 1200+ page deal. One area that was causing concern was data protection....
The trade agreement falls short of confirming adequacy status on the UK but it does contain specific transitional provisions relating to data protection at Article FINPROV.10A (pg 406).
In short:
for a period of 4 months from 1 Jan (which can be extended by a further period of 2 months unless one party objects), the UK will NOT be classified as a “third country” under EU law and as such the UK/EU can continue to transfer/process personal data between the UK and member states much in the same manner that it currently does;
the provisos apply to the EU including Iceland, Liechtenstein and Norway;
the above will cease to apply if the UK changes its current legislation or changes any of its designated powers without EU consent.
The period will also end if the UK is granted “adequacy status” but in reality it is hoped that the above arrangement will give the EU sufficient time to review and approve the UK as “adequate”. There are some concerns over the UK’s use of surveillance data but generally the view is that we should see the UK granted adequacy status in the near future.
What does this mean for businesses that see data transfer between the EU and the UK? This will mean that we can continue to operate pretty much on the same basis that we do now. This may change if we start to diverge from the EU position on data protection but for the time being we can all (hopefully) breath a sigh of relief.
Comments