EU and UK Data Sharing: UK Adequacy Decision | McDermott Will & Emery – JDSupra

On Feb 19 2021, a European Union Commission released a draft endowment decision for information flows between a European Union (EU) and United Kingdom (UK).

Whilst widely expected, this breeze preference will yield some declaration about a stability giveaway upsurge of information between a EU and UK nonetheless businesses should take mind of a few ongoing regulatory issues.

Post-Brexit (the UK’s exit from a European Union):

  • The UK mostly adopted a EU GDPR as standalone UK law
  • The UK became a “third country” for information flows from a EU
  • Transitional supplies have been practical to concede information flows between a UK and a EU. The EU-UK Trade and Co-operation Agreement concluded on Dec 24, 2020 enclosed a “bridge period” of 4 to 6 months to concede for a EU Commission to adopt an endowment preference underneath a GDPR for a UK
  • The UK deemed a EEA to be adequate on a transitory basis, a position expected to be a box until 2024. The UK also defended a EU customary contractual clauses as a send mechanism
  • The UK also adopted prior EU endowment decisions definition that information might continue to flow, as before, to countries outward of a EU, such as Japan, with adopted endowment decisions. The UK has pronounced it will keep these endowment decisions underneath review

The speed of emanate of this breeze preference will yield some comfort to businesses operative opposite a EU and UK, though there are a few pivotal issues to delicately consider. The breeze preference contingency still be reviewed by a European Data Protection Board and afterwards needs a “green light” from member of EU member states underneath a “comitology” procedure.

What Does Adequacy Mean?

In brief, an endowment preference means that a EU has supposed that a UK information insurance regime affords adequate protections for EU information subjects.

If a preference is adopted, information might continue to upsurge between a EU and UK though a need for additional provisions, such as customary contractual clauses or a adoption of contracting corporate rules.

There had been some doubt as to either special terms and conditions would be enclosed to take into comment a new Schrems II statute by a European Court of Justice, though a breeze endowment preference confirms that existent UK law is sufficient, and that no serve guarantee stairs need be taken by information exporters.

Regulatory Oversight – No “One Stop Shop”

Despite a endowment decision, a UK and a EU are still thesis to apart regulatory regimes.

From Jan 1, 2021 organisations that routine information in a EU and a UK (or if UK based, offer products or services, or aim people in a EU and clamp versa) are now thesis to both a EU GDPR and a UK GDPR and, depending on their operations might need to:

  • Appoint an EU deputy or a UK representative
  • Consider that EEA or EU supervisory management will be their lead authority, given that a UK Information Commissioner’s Office might no longer be a lead supervisory management for information controllers and information processors located in a UK though a categorical investiture in a EEA.

Adequacy and a Longer Term

The Adequacy decision, once adopted, will not be a permanent position. It will be re-examined each 4 years by a EU and by a UK. However, this examination duration is longer than a examination duration in other endowment decisions, for instance a Japan endowment preference allows for a examination each dual years, thesis to acknowledgment after a initial two-year review.

Some risk stays that any EU Adequacy preference might be challenged in a identical approach to a Safe Harbor and Privacy Shield supplies that were recently challenged in a Schrems II case. This might be deliberate a heightened risk given a European Court of Human Rights statute per a UK mass notice programme.

However, a EU UK Trade and Co-operation Agreement does embody supplies that predict a risk of destiny declarations of wrong transfers. The Agreement outlines a stairs to be taken by a Partnership Council to determine on corner interpretations, suggest suitable actions, adopt suitable adaptations and extend any suspensions. These supplies are formed on a need for destiny co-operation, and a need to take stairs to concede information to continue to upsurge between a EU and a UK.

Failing any fortitude by a EU-UK Trade and Co-operation Agreement provisions, choice mechanisms might need to be adopted to understanding with any invalidation, for instance a adoption of customary contractual clauses

Ongoing Opinions and Guidance – Some Divergence?

Despite a Adequacy decision, organisations handling in a EU and UK will need to continue to guard developments in both areas. A few examples to bear in mind below:

  • The EU is now consulting on revisions to a customary contractual clauses. Given that a UK has adopted a prior customary contractual clauses, it stays to be seen either a UK will also adopt any revised version
  • On Feb 2, 2021, a EU released guidance on health investigate and delegate use of data. A week later, on Feb 9, 2021, a UK announced a review into a use of health information for investigate and analysis. We will cover these developments in a apart destiny briefing
  • On a thesis of facilitating continued upsurge of data, a ICO published a prolonged awaited Data Sharing Code of Practice (the Code) during a finish of final year. Due to a minute approach in that a Code covers information pity in a context of a GDPR, it will also be of wider seductiveness to information controllers outward of a UK post-Brexit

[View source.]

You must be logged in to post a comment Login

Widgetized Section

Go to Admin » appearance » Widgets » and move a widget into Advertise Widget Zone