Agreement on data transfer with EU is good news for British businesses
Firms trading between the EU and the UK will regain confidence that transfers of personal data will now be deemed secure, says Helena Brown
For better or worse, the UK’S relationship with the European Union is becoming clearer following a period of protracted negotiations. For practitioners and organisations which transfer data between countries, we can now perhaps see some light at the end of the tunnel as it looks increasingly likely that the European Commission will grant the UK the sought-after status of 'data adequacy' for personal data transfers.
Although it has not yet been set in stone, following a draft 'adequacy decision' from the Commission on February 19, international businessestrading between theeu and theuk have regained confidence that their transfers of personal data will now be deemed secure, without having to go through complicated contractual and impact assessment processes.
Without this adequacy status, businesses already struggling with other Brexit related demands would face the potential pain of having to amend supply arrangements and contracts when the UK'S temporary arrangement with the EU on' safe data transfers'comes to an end on june 30. the welcome news from the commission has settled such concerns to a certain degree, but what does this mean for UK businesses?
Firstly, what is adequacy? EU data protection law places restrictions on the transfer of personal data outside of the European Economic Area (EEA) to countries deemed less secure. One way in which organisations can transfer personal data outsideof this trading bloc is where they do so to a' third' country that benefits from a so-called 'adequacy decision' of the Commission.
Adequacy is the status granted by the commission to outside countries which provide a level of personal data protection comparable to European standards. Canada, Switzerland and Japan are just some of the countries outside the EU that currently benefit from a Commission adequacy decision. Following Brexit, the UK is a third country to the EU so adequacy is not automatic.
The status of adequacy is really positive for business. It means they don’t need to enter into onerous contracts to cover data transfer risk, and will make it easier to win and conduct business with customers and suppliers in Europe. However politically, adequacy means some level of control remains from europe on how we handle privacy in the Uk.should the UK be granted data adequacy status, then we too will come under the microscope to ensure ongoing compliance with the strict EU requirements. This could, for example, cause issues as we enter trade deals with other countries involving transfers of data. The obvious example is the US, whose track record on government surveillance has led to a number of successful challenges from privacy activists - most notably the 'Schrems II' decision in 2020.
These claims have led to a much greater level of scrutiny from regulatorsaround personal data transfers –not just to the us, but to any territory internationally. Even with a de quacy,ukbusinesses who are exporting data outside Europe to other 'nonadequate' territories will still need to follow the new rules, which include a new form of risk analysis called a 'transfer impact assessment'.
With this in mind, we have been helping organisations to assess their data transfers, evaluate their risk, and make decisions on what steps they need to take to continue their personal data transfer sin apostbr exit world. This may mean changing procurement and supply processes, or even in some cases changing suppliers if the risks are too great.
By no means can organisations become complacent – firms which uphold robust data privacy controls and management will be best equipped should there be a curveball from the Commission around adequacy over the coming months. As part of this, the team at Addleshaw Goddard has been hosting a series of Data Download webinars to help explain the data implications that have arisen from Covid-19 and Brexit. To access the Data Download series, visit: www.addleshawgoddard.com Helena Brown is Partner and Head of Data, Addleshaw Goddard