On December 31, 2020, the United Kingdom left the European Single Market and the Customs Union. As a result, the UK is considered a so-called third country in relation to the EU starting January 1, 2021. In our last newsletters, we already wrote in detail about the effects this will have on data protection and, in particular, on the appointment of a UK DPO or a UK Representative.
Transition period for third country transfers
As far as international data flows are concerned, a transition period was agreed. This means that data transfers to the UK will eventually be considered as transfers to a third country – and thus be subject to all requirements under chapter V of the GDPR – but the latest agreement between the EU and the UK includes a further transition period on this very issue. Within this period, the UK is not yet considered a third country and the requirements under art. 44 et seq. GDPR do not apply yet.
The transitional period ends either with the adoption of an adequacy decision by the European Commission, or after the expiry of at least 4, but no more than 6 months after 1 January 2021.
The relevant provising in the Brexit Agreement reads as follows:
Article FINPROV.10A: Interim provision for transmission of personal data to the United Kingdom1) For the duration of the specified period, transmission of personal data from the Union to the United Kingdom shall not be considered as transfer to a third country under Union law, provided that the data protection legislation of the United Kingdom on 31 December 2020, as it is saved and incorporated into United Kingdom law by the European Union (Withdrawal) Act 2018 and as modified by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 201987 (“the applicable data protection regime”), applies and provided that the United Kingdom does not exercise the designated powers without the agreement of the Union within the Partnership Council. [… ]
4) The “specified period” begins on the date of entry into force of this Agreement and, subject to paragraph 5, ends:
(a) on the date on which adequacy decisions in relation to the UK are adopted by the European Commission under Article 36(3) of Directive (EU) 2016/680 and under Article 45(3) of Regulation (EU) 2016/679, or
(b) on the date four months after the specified period begins, which period shall be extended by two further months unless one of the Parties objects; whichever is earlier.
Negotiatiting an adequacy decision
The goal of the transitional phase is to provide time to negotiate an adequacy decision for the UK under art. 46 GDPR – this would allow data to be transferred between the EU and the UK without any additional requirements.
We have summarised the current situation in the following table:
Documentation requirements
Regardless of the need for a UK DPO, there may be other requirements in relation to cross-border data transfers. Therefore, check your privacy policy to make sure it is up to date regarding the section on third-country transfers and name your UK DPO and UK Representative, if necessary. Review your register of processing activities to have an overview of which data recipients, processors or tools are based in the UK and where additional safeguards might need to be implemented according to art. 44 et seq. GDPR. Check which additional safeguards would be possible here and whether there are any alternatives based in the EU.
We are happy to assist you with our expertise. Please do not hesitate to contact us at any time.