Initial analysis of EU-UK trade and co-operation agreement and impact on cross-border data flows
The EU and UK announced on the 24 December 2020 that they had reached political agreement about their on-going relationship after the end of the transition period, which ended on 1 January 20211.
We have been studying the Brexit Agreement to enable us to understand how it impacts our British and European clients. The Brexit Agreement is a complex document contained in 1256 pages covering all legal, political and regulatory issues which need to be addressed between the 2 parties.
This note is not intended to address any political issues nor is it intended to summarise the Brexit Agreement beyond its effect on data protection.
Data Protection: Brexit Agreement
The Brexit Agreement recognises that the EU and UK shall maintain continuously high standards of data protection for citizens whilst each being free to determine rules that apply within their respective territories2.
As an interim measure, from 1 January 2021 the UK will not be deemed a third country for the purposes of the GDPR. This means that the restrictions on data flows between the EEA and third countries do not apply to the UK. Data flows from the EEA to the UK can continue as they do currently, without the need for standard contractual clauses or other adequacy measures3. This issue resolves the need for deployment of standard contractual clauses for controller-to-controller or controller-to-processer transfers where the data exporter is an EU-based controller and the data importer is a UK-based controller or processor.
The interim measure will last until the earlier of:
- The European Commission granting the UK status as an adequate territory, something which the existing text of the Brexit Agreement does not do, but merely recognises should be done; or
- a period of 4 months from start date of the Brexit Agreement, with a right to extend by 2 months unless either the UK or EU object to such extension.
The Brexit Agreement does not address in detail what would happen if there is no adequacy decision within the (up to) 6 month time limit, meaning in default that the position would revert to the UK becoming a third territory requiring standard contractual clauses or another adequacy measure for lawful transfer.
The interim measure is conditional upon the data protection regime in the UK remaining as it currently is without significant deviation4.
Get in touch
For more information on this update, or any data protection related matters, please contact Matthew Holman.
This update does not constitute formal legal advice.
At the time of preparing this note, the EU and UK parliaments have not approved the Brexit Agreement. This approval is needed before the Agreement is finalised and further changes to the text may occur before such approval, although the probability of this occurring appears to be low. Initial EU approval is expected by 14:00 GMT 29 December 2020 with a vote by MEPs in early 2021 (followed by ratification by the EU Council), and UK parliament will be recalled to debate the Brexit Agreement and vote on 30 December 2020.
The full text of the Brexit Agreement can be accessed here
(1) Per European Union (Withdrawal) Act 2018
(2) Article LAW.GEN.4 at pages 283 and 284
(3) Article FINPROV10.1A sub article (1). Sub article (2) specifically includes Norway, Lichtenstein and Iceland
(4) Article FINPROV10.1A sub article (1) and (3)