The UK left the EU on January 31, 2020. On Christmas Eve, the two parties signed a Trade and Cooperation Agreement. Under the Agreement, EU personal data can be processed in the UK for six months. The European Commission will use the six-month period to evaluate the adequacy of British data protection laws.
Businesses wishing to process EU data in the United Kingdom after the transition period have several options. One is entering into the EU Standard Contractual Clauses. A second one is implementing Binding Corporate Rules. A third one is relying on any of the available GDPR derogations. Even so, these would be stop-gap measures. Ultimately, both parties would like to see the UK recognized as an “adequate” data processing destination. This recognition would enable the UK to process EU personal data without undertaking additional measures.
The Agreement incorporates data protection and privacy measures. Perhaps the most significant is the pledge to refrain from curtailing EU-UK data flows, or imposing data localization requirements. The British Government will acknowledge current adequacy determinations. This permits UK-EU data transfers unhindered by other regulations. The current regulations are encapsulated in the Data Protection, Privacy and Electronic Communications (Amendments, etc.) (EU Exit) Regulations 2019.
The UK Information Commissioner’s Office (“ICO”) has cautiously welcomed the Agreement. It noted that the agreement meant that data flows could continue without changes to current practices. Nevertheless, it suggested that UK businesses cooperate with their EU counterparts to safeguard against potential future data flow disruptions.
At a minimum, companies should undertake three steps.
First, update their data processing notices to reflect the new regulatory regime.
Second, they need to determine if they need to appoint a local representative in the European Union.
Third, they must verify that their counterparts have also updated their practices in line with the new requirements.
The European Union and United Kingdom have surprised skeptics by reaching the Agreement. But to channel a certain Englishman, the Agreement is not the end of Brexit. It is not even the beginning of the end. It is the end of the beginning.