New Year's gift for data transfers to the United Kingdom

Data transfers to the United Kingdom will continue to be possible for the time being on the basis of the final provisions of the Trade and Cooperation Agreement ("Brexit Agreement") of December 31, 2020.

For a transitional period of four months with an option to extend by another two months - or if an adequacy decision is in place before the end of this period until that time - the transfer of personal data from the EU to the United Kingdom is not considered a transfer to a third country within the meaning of Union law. Therefore, standard contractual clauses, Binding Corporate Rules or other safeguards under Article 46 of the GDPR are not required for transfers to the UK for the first time.  This means that any serious difficulties that may arise - with all the difficulties following the ECJ ruling Schrems II (https://www.skwschwarz.de/en/details/edpb-recommendations-for-third-country-transfers-published) and all the associated difficulties regarding the use of standard contractual clauses - have been postponed for the time being.

Pages 427/428 of the contract contain the following provision in this regard:

“Article FINPROV.10A: Interim provision for transmission of personal data to the United Kingdom

1) For the duration of the specified period, transmission of personal data from the Union to the United Kingdom shall not be considered as transfer to a third country under Union law, provided that the data protection legislation of the United Kingdom on 31 December 2020, as it is saved and incorporated into United Kingdom law by the European Union (Withdrawal) Act 2018 and as modified by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 ("the applicable data protection regime"), applies and provided that the United Kingdom does not exercise the designated powers without the agreement of the Union within the Partnership Council.

(...)

4) The "specified period" begins on the date of entry into force of this Agreement and, subject to paragraph 5, ends:

      (a) on the date on which adequacy decisions in relation to the UK are adopted by the European Commission under Article 36(3) of Directive (EU) 2016/680 and under Article 45(3) of Regulation (EU) 2016/679, or

      (b) on the date four months after the specified period begins, which period shall be extended by two further months unless one of the Parties objects;

whichever is earlier.”

Practical tip: What must be considered now in terms of data protection law?

• Until the aforementioned period has expired, data can be transferred to the United Kingdom for the time being as before (https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Brexit-Uebergangsfrist/Brexit-Uebergangsfrist.html).
• It is currently unclear when there will be an adequacy decision for the United Kingdom. If companies want to be on the safe side, they should take the precaution of implementing appropriate safeguards, such as standard contractual clauses, within the transition period. Otherwise, developments should at least be closely monitored.
• If a representative is to be appointed for a company pursuant to Art. 27 GDPR and the appointed representative is established in the UK, the company should appoint another representative established in the EU.
• Companies that base transfers of data to third countries on Binding Corporate Rules (BCRs) and these have been approved by the UK supervisory authority ICO should consider whether the BCRs can continue to be relied upon.
• The EU Commission is now called upon to present viable adequacy decisions that take into account the ECJ's current case law on Schrems II.

The SKW Data Protection Taskforce will, of course, keep you closely informed of further developments regarding the transfer of data to the United Kingdom.

Autoren:
Dr. Oliver Hornung
Philipp Sauer, LL.M.