The impact of the Brexit deal on personal data transfers from the EU to the UK

On 24 December 2020, the European Union ("EU") and the United Kingdom ("UK") finally struck a deal over Brexit. They notably reached a Trade and Cooperation Agreement ("TCA").

In respect of personal data protection, this TCA provides for a temporary period during which transfers made to the UK will not be considered as transfers within the meaning of the laws of the EU law, insofar as – inter alia – the UK Data Protection Act 2018 ("DPA") as amended in 2019 applies. The DPA was amended to incorporate the principles of the GDPR and has become the so-called UK GDPR. It will be applicable from 1 January 2021.

During that temporary period, certain designated powers referred to in the DPA and the UK GDPR can only be exercised by the UK with the consent of the EU.

The temporary period begins on 1st January 2021. It should end after either (a) four months, extendable by 2 additional months (unless one of the parties object) or (b) the date on which the UK is granted an adequacy decision by the European Commission, whichever is the earlier.

Should the UK not be granted an adequacy decision by the end of the 4-6 month temporary period, the situation will then be as if no deal intervened in this respect. For more information on this situation, please see our previous articles on the matter:

• Consequences of a no-deal Brexit on personal data transfers to the UK
• Brexit: Personal data transfers under and after the transition period

The text in the TCA in respect of transfers is on page 407 and is partly reproduced below for convenience¹ . The 1246 pages of the TCA are available here.

Article FINPROV.10A: Interim provision for transmission of personal data to the United Kingdom (excerpt)

1. 1. For the duration of the specified period, transmission of personal data from the Union to the United Kingdom shall not be considered as transfer to a third country under Union law, provided that the data protection legislation of the United Kingdom on 31 December 2020, as it is saved and  incorporated into United Kingdom law by the European Union (Withdrawal) Act 2018 and as modified by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (“the applicable data protection regime”), applies and provided that the United Kingdom does not exercise the designated powers without the agreement of the Union within the Partnership Council.
2. 2. Subject to paragraphs 3 to 11, paragraph 1 shall also apply in respect of transfers of personal data from Iceland, the Principality of Liechtenstein and the Kingdom of Norway to the United Kingdom during the specified period made under Union law as applied in those states by the Agreement on the European Economic Area done at Porto on 2 May 1992, for so long as paragraph 1 applies to transfers of personal data from the Union to the United Kingdom, provided that those states notify both Parties in writing of their express acceptance to apply this provision.
3. 3. In this Article, the “designated powers” means the powers:
   1. (a) to make regulations pursuant to sections 17A, 17C and 74A of the UK Data Protection Act 2018;
   2. (b) to issue a new document specifying standard data protection clauses pursuant to section 119A of the UK Data Protection Act 2018;
   3. (c) to approve a new draft code of conduct pursuant to Article 40(5) of the UK GDPR, other than a code of conduct which cannot be relied on to provide appropriate safeguards for transfers of
   4. (d) personal data to a third country under Article 46(2)(e) of the UK GDPR;
   5. (e) to approve new certification mechanisms pursuant to Article 42(5) of the UK GDPR, other than certification mechanisms which cannot be relied on to provide appropriate safeguards for
   6. (f) transfers of personal data to a third country under Article 46(2)(f) of the UK GDPR;
   7. (g) to approve new binding corporate rules pursuant to Article 47 of the UK GDPR;
   8. (h) to authorise new contractual clauses referred to in Article 46(3)(a) of the UK GDPR; or
   9. (i) to authorise new administrative arrangements referred to in Article 46(3)(b) of the UK GDPR.
4. 4. The “specified period” begins on the date of entry into force of this Agreement and, subject to paragraph 5, ends:
   1. (a) on the date on which adequacy decisions in relation to the UK are adopted by the European Commission under Article 36(3) of Directive (EU) 2016/680 and under Article 45(3) of Regulation (EU) 2016/679, or
   2. (b) on the date four months after the specified period begins, which period shall be extended by two further months unless one of the Parties objects;
5. whichever is earlier.