[updated version of an article initially published on 4 February 2021]
As a result of Brexit, the UK is a third country in relation to the GDPR, as of 1 January 2021.
The EU-UK Trade and Cooperation Agreement ("the agreement") includes a bridging mechanism on further exchange of personal data between the EU and the UK. This mechanism lasts for a transition period of four months initially (until 30 April 2021) with the possibility of extending it for another two months (until 30 June 2021).
During the transition period, the transfer of personal data between the EU and the UK will not be considered as a transfer to and from a third country, provided that the UK adheres to the conditions listed in the agreement and no adequacy decision is adopted during the transition period.
After the transition period, the free flow of data to the UK will no longer be possible without (i) an adequacy decision from the European Commission, or (ii) the implementation of a data transfer tool as listed in Chapter V of the GDPR.
Adequacy decision: On 19 February 2021, the European Commission initiated the process towards the adoption of two adequacy decisions for transfers of personal data to the United Kingdom: (i) an adequacy decision under the General Data Protection Regulation (GDPR), and (ii) for the first time, an adequacy decision under the Law Enforcement Directive (LED). Before the decisions can be formally adopted by the Commission, the European Data Protection Board will issue a non-binding (although likely persuasive) opinion. The decisions will be formally adopted after they have been formally approved by a committee composed of EU Member State representatives.
Once adopted, the decisions would be valid for an initial period of four years, with a possibility to renew the adequacy finding if the level of protection in the UK continued to be adequate after those four years.
Standard Contractual Clauses and binding corporate rules: It remains to be seen whether an adequacy decision will actually be adopted in the end. If no adequacy decision is adopted by the European Commission by the end of the transition period, personal data can only be transferred on the basis of the appropriate safeguards and derogations listed in Articles 46 or 49 GDPR, e.g. by concluding standard contractual clauses or adopting (new or adapted) binding corporate rules. Since the Court of Justice's Schrems II judgment, data controllers (data exporters) need to comply with additional requirements when transferring personal data to a recipient located in a third country (data importer). For more information, please see our earlier analysis.
