Update on Data Transfers to UK Post Brexit
Tue Apr 20 2021
As you are aware, interim provisions for data transfers to the UK post Brexit were contained in the Brexit agreement reached on the 24th of December 2020. It provided that for the duration of the specified period (which came into force on the date of the agreement), transmission of personal data from the Union to the United Kingdom shall not be considered as transfer to a third country under Union law and data transfers to the UK could continue without the need for SCCs to be put in place for the duration of the transition period (until end of June).
Work is ongoing at EU level in relation to the granting of an Adequacy decision with the EDPB (European Data Protection Board) issuing opinions last week recognising that the UK has mirrored, for the most part, the GDPR and LED in its data protection framework and when analysing its law and practice, the EDPB identified many aspects to be essentially equivalent. The EDPB welcomed the establishment of the Investigatory Powers Tribunal (IPT) to address the challenges of redress in the area of national security, and the introduction of Judicial Commissioners in the Investigatory Powers Act (IPA) 2016 to ensure better oversight in that same field – these were key issues in relation to granting adequacy.