Brexit: further transfer of personal data to the United Kingdom without supervision is allowed
The European Commission has adopted two adequacy decisions in order to continue to transfer personal data to the United Kingdom without more specific guidance.
The adoption of Adequacy Decisions by the European Commission makes it possible to simplify and streamline transfers of personal data from the European Union to third countries without compromising their level of protection. In this way, if a third country has an “adequate level of protection“, the transfer of personal data to that country without specific authorisation is possible.
To facilitate the flow of personal data to the United Kingdom, “a third country” since 1 January 2021 following the Brexit, the European Commission adopted two adequacy decisions on 28 June. These adequacy decisions take over the transitional provisions established by the European Union and the United Kingdom. Indeed, a trade and cooperation agreement had been concluded between the European Union and the United Kingdom on 24 December 2020, providing in particular that the GDRP would remain applicable on a transitional basis in the United Kingdom for a period of six months. Until 1 July 2021, the transfer of personal data to the UK had continued under the previous framework, without the UK being considered a third country.
Thus, with these two decisions, the first on the GDPR, and the second on data protection in law enforcement, the European Commission now considers that the level of UK data protection is “substantially equivalent” to that guaranteed by EU law.
As a result, the European Commission allows the continued transfer of personal data of EU citizens to the UK – considered as “a third country” – without further specific guidance, thus leaving controllers and processors free to carry out such processing, without additional conditions.
However, transfers made for the purpose of UK immigration control are outside the scope of the adequacy decision under the GDPR, an exclusion that will be examined by the European Commission once the situation has been resolved under UK law.
Par Anne-Marie Pecoraro et Corinne Khayat.
Sources :
« Brexit : le transfert de données personnelles vers le Royaume-Uni est possible sans encadrement », 27/10/2021, © Editions Francis Lefebvre 2021
https://brexit.gouv.fr/sites/brexit/accueil/vous-etes-une-entreprise/protection-des-donnees.html
https://eur-lex.europa.eu/legal-content/FR/TXT/PDF/?uri=CELEX:32016L0680