The UK and the European Union have agreed to temporarily keep existing data transfer arrangements in place for up to six months while negotiations continue over a permanent adequacy solution. GDPR has been retained in UK law and renamed the UK GDPR.
This ‘bridging mechanism’ allows data to be transferred in the same way it was pre-1 January 2021 for a ‘specified period’ of four months, extendable by a further two months, provided that the UK makes no changes to its rules on data protection in the interim.
The period will end when the European Commission (EC) adopts an adequacy decision in relation to the UK, which has always been a separate process to the trade negotiations. If this has not happened by 1 April then the period will be extended by two more months to 1 June, unless either the UK or the EU objects.
The UK has already deemed the EU/EEA to be adequate on a transitional basis, meaning that data can also continue to flow freely from the UK to the EU/EEA while the UK makes its own formal adequacy assessments.
While nothing is certain, the way in which adequacy is addressed in the agreement means we can be cautiously optimistic about the UK being granted adequacy. This would allow data transfers from the EU/EEA to the UK on the same basis as now.
Both the Market Research Society (MRS) and the Advertising Association (AA) have also advised members to take precautions in case an agreement on data adequacy is not reached.
This advice includes having alternative data transfer mechanisms in place, such as standard contractual clauses (SCC), to ensure there is no disruption to the flow of data between the UK and the EU.
Regardless of the origin of the data being used, it is worth checking with your legal team and Data Protection Officer to ensure data collection policies and handling processes are up to date.
