Agreement on data transfer with EU is good news for British businesses - Helena Brown

For better or worse, the UK’s relationship with the European Union is becoming clearer following a period of protracted negotiations. For practitioners and organisations which transfer data between countries, we can now perhaps see some light at the end of the tunnel as it looks increasingly likely that the European Commission will grant the UK the sought-after status of 'data adequacy' for personal data transfers.

Helena Brown is Partner and Head of Data, Addleshaw Goddard

Although it has not yet been set in stone, following a draft 'adequacy decision' from the Commission on February 19, international businesses trading between the EU and the UK have regained confidence that their transfers of personal data will now be deemed secure, without having to go through complicated contractual and impact assessment processes.

Without this adequacy status, businesses already struggling with other Brexit related demands would face the potential pain of having to amend supply arrangements and contracts when the UK's temporary arrangement with the EU on 'safe data transfers' under the Trade and Cooperation Agreement comes to an end on June 30. The welcomed news from the Commission has settled such concerns to a certain degree, but what does this mean for UK businesses?

Firstly, what is adequacy? EU data protection law places restrictions on the transfer of personal data outside of the European Economic Area (EEA) to countries deemed less secure. One way in which organisations can transfer personal data outside of this trading bloc is where they do so to a 'third' country that benefits from a so-called 'adequacy decision' of the European Commission.

Adequacy is the status granted by the Commission to outside countries which provide a level of personal data protection comparable to European standards. Canada, Switzerland and Japan are just some of the countries outside the EU that currently benefit from a Commission adequacy decision. Following Brexit, the UK is a third country to the EU so adequacy is not automatic.

The status of adequacy is really positive for business. It means they don’t need to enter into onerous contracts to cover data transfer risk, and will make it easier to win and conduct business with customers and suppliers in Europe. However politically, adequacy means some level of control remains from Europe on how we handle privacy in the UK. The use of data in adequate countries comes under the scrutiny of the European Parliament and Council, who have the power to request the European Commission to maintain, amend or withdraw the adequacy decision.

Should the UK be granted data adequacy status, then we too will come under the microscope to ensure ongoing compliance with the strict EU requirements. This could, for example, cause issues as we enter trade deals with other countries involving transfers of data. The obvious example is the US, whose track record on government surveillance has led to a number of successful challenges from privacy activists – most notably the 'Schrems II' decision in 2020.

These claims have led to a much greater level of scrutiny from regulators around personal data transfers – not just to the US, but to any territory internationally. Even with adequacy, UK businesses who are exporting data outside Europe to other 'non-adequate' territories will still need to follow the new rules, which include a new form of risk analysis called a 'transfer impact assessment'.

With this in mind, we have been helping organisations to assess their data transfers, evaluate their risk, and make decisions on what steps they need to take to continue their personal data transfers in a post-Brexit world. This may mean changing procurement and supply processes, or even in some cases changing suppliers if the risks are too great.

By no means can organisations become complacent – firms which uphold robust data privacy controls and management will be best equipped should there be a curveball from the European Commission around adequacy over the coming months. As part of this, the team at Addleshaw Goddard has been hosting a series of Data Download webinars to help explain the data implications that have arisen from Covid-19 and Brexit.

New challenges are likely to be forthcoming but I hope by driving awareness now it will reduce some of the negative fall-out from any changes to the guidance.

To access the Data Download series, visit:https://www.addleshawgoddard.com/en/insights/insights-briefings/on-demand-webinars-podcasts/data-download-webinar-series/

Helena Brown is Partner and Head of Data, Addleshaw Goddard