After years of wrangling and with the clock ticking louder by the day, British and European negotiators provided a temporary grace period for data flows to continue between the EU and U.K. In the Trade and Cooperation Agreement signed between the EU and U.K. Dec. 24, 2020, data transfers for business and law enforcement purposes can continue until adequacy decisions under the EU General Data Protection Regulation and the Law Enforcement Directive are approved before the end of a six-month grace period.
The agreement was announced Christmas Eve and includes a "bridging mechanism" that buys privacy pros a little more time — up to six months — for handling data transfers. Conferring an adequacy decision on the U.K. will require a proposal from the European Commission, an opinion from the European Data Protection Board, approval by EU member state representatives and an adopting decision by the commissioners. According to Fieldfisher's Eleonor Duhs, CIPP/E, the agreement "paves the way for adequacy."
Of the trade agreement, European Commission President Ursula von der Leyen said, "Finally, we can leave Brexit behind us and look to the future. Europe is now moving on."
The U.K. Information Commissioner's Office noted that as "a sensible precaution, before and during this period, the ICO recommends that businesses work with EU and (European Economic Area) organizations who transfer personal data to them, to put in place alternative transfer mechanisms, to safeguard against any interruption to the free flow of EU to (U.K.) personal data." The U.K. had already deemed the EU and EEA states to be adequate for the flow of data from the U.K.
IAPP Senior Westin Research Fellow Henriette "Jetty" Thielemans created a "Brexit Privacy Checklist" for privacy pros late last year.
"This is the best possible outcome for U.K. organizations processing personal data from the EU," Information Commissioner Elizabeth Denham said. "This means organizations can be confident in the free flow of personal data from (Jan. 1), without having to make any changes to their data protection practices. We will be updating the ICO guidance on our website to reflect the extended provisions and ensure businesses know what happens next. At this stage it's good news for businesses and public bodies."
France's data protection authority, the Commission nationale de l'informatique et des libertés, pointed out the trade agreement means the "one-stop shop" mechanism will no longer apply in the U.K. as of Jan. 1. Data controllers and processors established only in the U.K. that are subject to Article 3(2) of the EU General Data Protection Regulation will be required to now appoint a representative in the EU under Article 27.
The CNIL also said EU supervisory authorities have maintained contact with the ICO in recent months for an "orderly transition ... ensuring that the Union authorities follow a coordinated approach in dealing with existing complaints and cross-border cases involving the ICO in order to minimize possible delays ... for the complainants concerned."
Promontory's John Bowman, CIPP/E, CIPM, FIP, who has been following the Brexit negotiations closely, characterized the agreement as being pragmatic. "The interim provision in the trade and cooperation agreement ... appears to be a pragmatic response to time running out for a U.K. adequacy decision in 2020. What is unusual about this development is that the provisional status quo arrangement is contained within the so-called trade deal," he said.
Bowman told The Privacy Advisor that U.K. adequacy "remains a unilateral decision of the European Commission, which is subject to the approval of the Council of the European Union ... taking into account the opinion of the European Data Protection Board on the draft decision."
"In data protection terms," he said, "the U.K. is now a third country, but this interim provision enables EU-to-U.K. data flows to continue for the next four months with a possible two-month extension. The political case for maintaining data flows for now within the framework of the wider trade deal may have been more compelling to the European Commission than disruption to those flows."
In her post about the agreement, Fieldfisher's Duhs noted there "is a wider context to consider," particularly regarding adequacy. "To suggest that the U.K. is not adequate would set the bar for adequacy impossibly high. It could create substantial difficulties for the EU in conferring new adequacy decisions (for example on South Korea or on certified U.S. companies under any replacement for Privacy Shield). It could also prove a barrier to continuing existing adequacy decisions." She added, "Without adequacy, substantial extra compliance burdens would arise for EU businesses who transfer data to the U.K., at a time when many can ill afford it."
If the U.K. does gain adequacy in the next six months, it could be challenged. Politico reported some privacy advocacy organizations "have long questioned the legality of Britain's surveillance powers and are likely to attack any adequacy decision on those grounds." Moreover, Dutch MEP Sophie in 't Veld has criticized the commission's work with the U.K. saying, "Where the EU stuck to its guns on trade and fish, it seems to be very eager to give in on data protection and fundamental rights."
It's also notable that, under the agreement, the U.K. cannot negotiate data flow agreements with other third-party countries, such as the U.S., during the bridging mechanism. However, data flows from the U.K. to third countries would follow the same process as before under the U.K. GDPR and the Data Protection Act 2018.
"What is clear," Bowman said, "is that this adequacy process will be subject to a level of scrutiny over the coming months not seen since the Privacy Shield, and all parties will want to see it concluded one way or the other once the interim provision expires."
Photo by Rocco Dipoppa on Unsplash
