EU/EEA-UK personal data flows after 1 January 2021

Data flows from the EU/EEA to the UK

The UK-EU Trade and Cooperation Agreement, announced on 24 December 2020, extends the free flow of personal data between the EU/EEA and the United Kingdom for up to six months. This agreement has been provisionally applicable since 1 January 2021, subject to parliamentary approval. It means that personal data can continue to flow freely from the EU and the EEA to the UK without additional measures.

The UK and EU have agreed to a transition period for an initial four months, until 30 April 2021. However, this period will be extended automatically to six months unless either the EU or the UK objects, meaning that the data transition period would end on 30 June 2021. Therefore, despite the UK now being considered a ‘third country’ under the EU GDPR, UK businesses can continue to receive personal data from the EU/EEA during this period. During this time, the European Commission will determine whether or not the UK provides an adequate level of protection for personal data to qualify for an EU adequacy decision. Data adequacy is a status granted by the European Commission to countries outside of the EU/EEA that demonstrate a level of personal data protection comparable to that provided in European law.

The free flow of data between the EU/EEA to the UK during this period is, however, conditional on the UK not amending the data protection laws which it had in place as at 31 December 2020 and not exercising certain designated powers without the agreement of the EU.

If an adequacy decision is made in respect of the UK, EU and EEA member states will be able to continue to transfer personal data after the transition period without the need for any additional procedures. The UK is hopeful that this will be the outcome considering that the Data Protection Act 2018 incorporates the General Data Protection Regulation and includes limited derogations.

If an adequacy decision is not made in favour of the UK, organisations in the EU and EEA member states will need to rely on alternative data transfer mechanisms such as Standard Contractual Clauses (SSCs) to transfer personal data to the UK.

Data flows from the UK to the EU/EEA

For personal data going in the opposite direction (i.e. from the UK to the EU/EEA), the UK Government had already deemed that the EU/EEA member states provide an adequate level of protection for personal data. This means that no additional safeguards are needed for such transfers.

How can we help?

For further information on data transfers, including the use of Standard Contractual Clauses, please get in touch with our specialist Data Protection & Cyber Security team.

Keep an eye on our Insights for further updates on the trade agreement.

This article was co-written by Calum Lavery, Trainee Solicitor.

Latest updates from @MacRoberts

  • Would you like to work at one of Scotland’s leading law firms? We currently have a number of opportunities availabl… 21/06/2021
  • We currently have a vacancy for a Customer Due Diligence Administrator based in Glasgow or Edinburgh. Please shar… 18/06/2021
  • Maya Forstater received a lot of media attention around her tweets relating to her beliefs about sex, resulting in… 18/06/2021
  • Applications for our traineeships starting in 2023 are now open! Get your legal career off to the best possible sta… 18/06/2021
  • RT @DundeeAndAngus: Leading Scottish commercial law firm, @MacRoberts has advised BAM on the ‘game-changing’ Atlantic Square development in… 16/06/2021
  • This week on our new IGTV mini-series, giving an insight into what it’s like to begin a legal career during the pan… 16/06/2021
  • Self-employed status: What does the Uber case really mean? 🚖 Kenny Scott explains what the recent ruling means for… 16/06/2021
  • What is the Scottish #gin industry doing to improve #sustainability? Following #WorldGinDay celebrations over the w… 15/06/2021
  • The European Commission has adopted & published versions of two new sets of Standard Contractual Clauses. What ch… 15/06/2021
  • What impact could Ireland High Court's decision to reject an action by Facebook to block an inquiry by the Irish… 14/06/2021
  • Wishing all of our followers a happy #WorldGinDay! ICYMI: Earlier this week, we were delighted to catch up with… 12/06/2021
  • We're #hiring! We have a #vacancy for a Senior #Solicitor or Associate to join our IP, Technology & Commercial team… 10/06/2021
  • Dealing with an employee's misconduct when that employee contends it is linked to a disability can be tricky - read… 09/06/2021
  • MacRoberts' have launched a new IGTV mini-series, giving an insight into what it’s like to begin a legal career dur… 09/06/2021
  • Scotland's new #landownership transparency register - the Register of Persons Holding a Controlled Interest in Land… 09/06/2021