The UK and EU have reached a trade deal. With 5 days before it comes into force, there’s barely enough time for the politicians to ratify it, let alone analyse all 1,256 pages. As if the politicians would be the ones poring over the detail: that will fall to the economists, analysts and, of course, the lawyers. The purpose of this post is not to assess the deal, just the data provisions. The agreement is here (PDF) if you fancy some light reading.
One thing is clear: data transfers will continue freely as at present between the UK and the EEA for up to 6 months. This should allow sufficient time for the EU Commission to confirm the UK’s data protection laws adequately comply with GDPR standards. In theory, this should be a rubber-stamping exercise of UK laws. The only fly in the ointment is likely to be the UK’s extensive snooping laws. Similar laws in the USA scuppered the Safe Harbour and its successor, Privacy Shield. We might see a couple of years of activity where an adequacy decision is issued by one EU institution (the Commission) followed by another one (ECJ) cancelling it. Max Schrems probably has his hands full already but there are no shortage of data protection activists.
Whatever happens, businesses have a grace period. They don’t need to rush out and enter into data transfer agreements adopting the EU Commission’s model clauses to allow data transfers to continue. Better late than never but this should come as a great relief to many businesses. Assuming the EU Commission issues an adequacy decision before the end of June 2021, this situation will continue, preserving data flows for longer.
Of course, there is still the possibility that the ECJ and the UK Supreme Court will rule differently on the same point of law. Judges are less prone to the histrionics or whimsies of politicians, but never say never. That scenario could lead to further tensions and, ultimately, affect data flows.
This trade deal is not the beginning of the end; it is the end of the beginning. The next few years will see some interesting developments. But at least we have certainty in the immediate term.
If you need advice, contact me firstname.lastname@example.org or +44 (0) 20 7611 2338.