On the 24th Decemeber, UK and EU negotiators finalised an agreement for how trade of goods and services can flow between the two parties.The agreement covers pivotal areas for many industries and across farming, fisheries, manufacturing and financial services.
The question of whether an agreement can be reached for the coninuation of free flowing data between the UK & EU has been an area of concern throughout the transition period. Without a trade deal, there was a risk that the UK would become a third country and data transfers from the EU to the UK would cease.
Privacy professionals have been pleased to hear that the treaty between the UK and the EU includes an agreement to allow data transfers to continue as they have done throughout the transition perion. The data transfer agreement has been agreed for a four month term with a possible extension of two further months. The optics of this agreement signifies a position view of the UK's possible qualification for "adequecy", which is granted to countries that the EU deems to have equivilent protections for personal data and the other appropriate laws. Without adequacy, the UK would be seen as a "third country", which adds significant complexity to data transfers between a third country and the EU.
The Information Commissioners Office, the UK's data protection authority, issued a statement on the data agreement, but also highlighted the need to be prepared for alternative data transfer mechanisms in case there were any delays or hitches in the UK's adequacy decision.
As a sensible precaution, before and during this period, the ICO recommends that businesses work with EU and EEA organisations who transfer personal data to them, to put in place alternative transfer mechanisms, to safeguard against any interruption to the free flow of EU to UK personal data.
Information Commissioner, Elizabeth Denham said:
“This is the best possible outcome for UK organisations processing personal data from the EU.
“This means that organisations can be confident in the free flow of personal data from 1 January, without having to make any changes to their data protection practices."
Get in touch with our data protection team if you have concerns about working with EU based customers, suppliers and employees, or ensuring that data can continue to flow in compliance with UK & EU legislation.