If personal data is processed outside the European Economic Area (EEA), your organisation needs to take additional measures. In practice, 'Standard Contractual Clauses' are commonly used for this purpose. This practice was also in the offing for the UK. However, an adequacy decision by the European Commission for the UK seems imminent. Good news for organisations exchanging personal data with UK organisations.Adequacy decision for UK looks imminent.
Although the UK has not been part of the EEA since 1 February 2021, a transition period of 4 months has been agreed for data exchange between the EEA and the UK. This period may be extended by 2 months to 1 July 2021. Although unknown at the time of writing, the extra 2 months will most likely be used. Indeed, it seems likely that an adequacy decision for the UK will be adopted before 1 July.
In February, the European Commission submitted a draft adequacy decision to the European association of national privacy regulators (EDPB). The EDPB issued a mostly positive opinion on 16 April, mainly because the UK has largely incorporated European privacy legislation into national law.
If the UK is classified as an 'adequate country' by the European Commission, it means that an adequate level of protection for the processing of personal data is ensured. Organisations will then not need to take additional measures for data exchange in the UK. Good news, as it prevents your organisation from having to enter into completely new processor agreements with UK organisations.
Your organisation would do well to take stock of which parties there are data exchanges with in the UK. Your processing register can serve as a guide. If an adequacy decision is actually made for the UK, processor agreements only need to be amended on a limited number of points. Consider, for example, provisions regarding transfers outside the EEA. You can add amendments in the form of an annex to existing agreements. In addition, your privacy policy, for example, will need to be updated.
If an adequacy decision is not adopted, organisations will have a lot of work ahead of them. It is therefore to be hoped that the European Commission will work on it.
Any questions? Of course, we are happy to be your discussion partner.