Brexit and GDPR: How to Manage Personal Data?

Update of information: On June 28, the European Commission recognized that the UK provides a level of protection for personal data equivalent to that guaranteed within the European Union and therefore adopted an adequacy decision in its favor (with a duration limited to 4 years). From now on, any transfer of personal data to the UK is allowed in compliance with the principles of the GDPR and can be carried out without the need to implement standard contractual clauses or other specific guarantees required for non-EU and non-adequate countries. It is worth noting that a reform on personal data protection is currently under review in the UK. The European Commission has already announced that it will closely monitor this reform and will take any necessary actions if problematic developments arise that could jeopardize the scope and durability of this agreement.

As Brexit came into effect on January 1, 2021, the management of personal data between the United Kingdom and the EU member states (“the Union”) follows a different timeline. Indeed, a transition period was open until December 31, 2020, during which the UK remained part of the Union’s customs territory, the internal market, and Union law continued to apply. During this period, negotiations took place between the parties and led, on December 24, 2020, to the presentation of a cooperation and trade agreement. This agreement now defines the terms of cooperation between the UK and the Union in certain areas, notably the circulation of data. These measures will have an impact in the coming months on commercial and contractual relationships when personal data are part of the scope of the contract.

Personal Data: A Transitional Agreement Until July 1, 2021

Under the cooperation and trade agreement signed between the Union and the UK, the European data protection regulation (“GDPR”) will remain applicable, on a transitional basis, to the UK for an additional period of up to 6 months, i.e., until July 1, 2021.

As of then, until July 1, 2021, the transfer of personal data to the UK will continue under the current framework and will not be considered as a transfer of data to a third country, where appropriate safeguards need to be put in place to ensure adequate protection.

Article 44 of the GDPR establishes the principle that the transfer of personal data to a third country is possible provided that a sufficient and appropriate level of data protection is ensured. In the absence of an adequacy decision by the European Commission, these transfers must be governed by various legal tools, such as standard contractual clauses in the contractual documentation, binding corporate rules (“BCR”), codes of conduct, or certification mechanisms.

Thus, at the end of these six months, any transfer of personal data to the UK will be considered a transfer to a third country and will require the implementation of appropriate safeguards unless the European Commission recognizes the UK as a country with an adequate level of protection.