Adequacy decision
It is very encouraging to see continued steps being taken that will hopefully allow the free flow of personal data from the EEA to the UK. This encouragement stems from the draft adequacy decision, published by the European Commission. The ICO and UK Government have both welcomed this draft agreement and see this as a positive step towards an adequacy decision being made.
The UK is now governed by The UK GDPR and Data Protection Act 2018 however; we are still waiting for an adequacy decision to be made by the European Commission. This decision will determine if the UK can continue to transfer data from the EEA to the UK. Without this adequacy decision, the UK will have to explore implementing additional safeguards such as:
- Standard Contract Clauses
- Binding Corporate Rules
- Additional layers of security – encryptions and pseudonymisation
- An up-to-date data flow map (good practice dictates that employers have one of these for each processing activity that they complete)
As a nation, the UK has already been granted ‘adequacy’ for transfers of personal data from the UK to the EEA.
We will keep you updated as this decision unravels. The UK continue to operate within the 6 months ‘grace period’ in respect of GDPR decisions following Brexit.
Standard contract clauses (SCC’s)
If employers are required to use SCC’s they should continue to use the EU versions as published on the ICO’s website, click here to access them. Draft versions of the UK’s SCC’s have been submitted to the European Commission and are currently being reviewed. Following our 6 months grace period the UK will be required to use their own version of these documents.
Once the UK’s SCC’s have been approved, employers will have a year grace period to embed and implements these agreements.
As soon as these SCC’s are agreed we will update you.
Schrems II
Following the Schrems II judgement that was announced in July 2020, the European Data Protection Board has published draft guidance. The consultation on this guidance closed in December 2020 and we are therefore, eagerly awaiting the outcome from this consultation. Hopefully, this will provide some much needed clarity and practical solutions surrounding the international data transfer challenges.
As soon as guidance is released surrounding this subject we will update you.
How we can support you?
The UK are waiting for a number of key GDPR decisions to be made, our hope is that these will be confirmed in the coming months. In the meantime, keep operating as you are but please have an awareness of what may be required from you.
If you need further help with Data Protection or have specific queries about this blog, please do not hesitate to get in touch. Our DPO service can provide as little or as much help as you need. You can find out more on this link or call our team on 01924 827869.
