International transfers of data after Brexit: Old GDPR rules still apply for six-month extension period

By Deborah Margolis - 8 January 2021

By way of reminder, transfers from within the European Economic Area (“EEA”) to outside the EEA (which would include the UK following Brexit) are only permissible where appropriate safeguards are put in place. For international businesses that regularly transfer data from the EU to the UK, it was not initially clear what the position would be for such transfers of data from 1 January 2021.

As you may have seen in the press, the UK and the EU reached an agreement on Brexit on Christmas Eve, which included arrangements for transfers of data to the UK following the end of the transition period. The summary of the Brexit agreement, which was published by the UK government, explains that the UK and EU have agreed to a grace period of up to six months during which personal data can flow freely from the EU to the UK (essentially maintaining the position that was in place before Brexit for an additional 6 months). During this period, the European Commission will work to complete its adequacy determination with the UK, which if obtained would allow the uninterrupted free flow of personal data between the EU and the UK without additional measures being put in place.

The UK’s data protection regulator, the ICO (Information Commissioner's Office) has issued a brief statement which explains that as a sensible precaution, businesses which transfer data from the EU to the UK can put in place alternative transfer mechanisms, to safeguard against any interruption to the free flow of EU to UK personal data. We consider that this is likely to be a cautious approach and in practice many businesses will instead keep a look out for whether the UK will be granted an adequacy decision before the grace period expires.

This short postponement and extension of the status quo will undoubtedly come as welcome news for businesses which have had to face a number of unexpected challenges over the last year.

If you would like to discuss this further, please get in touch with your usual GQ|Littler contact or email Deborah Margolis.