Brexit: further transfer of personal data to the United Kingdom without supervision is allowed

25/11/2021

The European Commission has adopted two adequacy decisions in order to continue to transfer personal data to the United Kingdom without more specific guidance.

The adoption of Adequacy Decisions by the European Commission makes it possible to simplify and streamline transfers of personal data from the European Union to third countries without compromising their level of protection. In this way, if a third country has an “adequate level of protection“, the transfer of personal data to that country without specific authorisation is possible.

To facilitate the flow of personal data to the United Kingdom, “a third country” since 1 January 2021 following the Brexit, the European Commission adopted two adequacy decisions on 28 June. These adequacy decisions take over the transitional provisions established by the European Union and the United Kingdom. Indeed, a trade and cooperation agreement had been concluded between the European Union and the United Kingdom on 24 December 2020, providing in particular that the GDRP would remain applicable on a transitional basis in the United Kingdom for a period of six months. Until 1 July 2021, the transfer of personal data to the UK had continued under the previous framework, without the UK being considered a third country.

Thus, with these two decisions, the first on the GDPR, and the second on data protection in law enforcement, the European Commission now considers that the level of UK data protection is “substantially equivalent” to that guaranteed by EU law.

As a result, the European Commission allows the continued transfer of personal data of EU citizens to the UK – considered as “a third country” – without further specific guidance, thus leaving controllers and processors free to carry out such processing, without additional conditions.

However, transfers made for the purpose of UK immigration control are outside the scope of the adequacy decision under the GDPR, an exclusion that will be examined by the European Commission once the situation has been resolved under UK law.

Par Anne-Marie Pecoraro et Corinne Khayat.

Sources :

« Brexit : le transfert de données personnelles vers le Royaume-Uni est possible sans encadrement », 27/10/2021, © Editions Francis Lefebvre 2021

https://brexit.gouv.fr/sites/brexit/accueil/vous-etes-une-entreprise/protection-des-donnees.html

https://www.cnil.fr/fr/brexit-la-commission-europeenne-adopte-des-decisions-relatives-ladequation-du-niveau-de-protection

https://ec.europa.eu/info/sites/default/files/decision_on_the_adequate_protection_of_personal_data_by_the_united_kingdom_-_general_data_protection_regulation_fr_0.pdf

https://eur-lex.europa.eu/legal-content/FR/TXT/PDF/?uri=CELEX:32016L0680

Transposition of Article 17 of Directive 2019/790: setting an audience threshold (400,000 unique visitors) and uploaded works (variable according to type)

IP-IT-Media
The determination of the platforms falling within the scope of Article 17 of the Copyright Directive, transposed into French national law, has been clarified with the publication in the Official…

The future of television and streaming

IP-IT-Media
French television channels are increasingly switching to streaming to vary their offers, services and content and to stand out from competitors. Given the increasing popularity of streaming in the media,…

The development of the draft "CABLE-SATELLITE" decree

IP-IT-Media
Following the first public consultation on the draft decree on the film and audiovisual contribution of television and radio service publishers distributed by networks not using frequencies assigned by the…