Brexit and the impact on data transfer
As of 1st January 2021, the UK and Northern Ireland are no longer a part of the European Union, and with this significant change come adjustments to policies and legislation.
The EU-UK Trade and Cooperation Agreement sets out arrangements between the EU and the UK in several areas including trade of goods and services, digital trade and data transfer, intellectual property and public procurement. The Agreement is underpinned by policy and provisions that aim to ensure equal opportunity and respect for fundamental rights.
Along with changes to the movement of goods between the EU and the UK, as well as between the UK and NI, changes have also been implemented with regards to the transfer and use of data. The UK is now received as a third country to the European Economic Area (EEA includes EU countries and also Iceland, Liechtenstein and Norway) and therefore data transfer from EEA to UK is restricted; data transfer however out of the UK to the EEA is not. Northern Ireland is not treated any differently to the rest of the UK for data protection purposes.
As part of the new trade deal, the EU agreed to delay transfer restrictions through a bridging arrangement. This provision is in place until the end of April however there is possibility of extension to the end of June if no “Adequacy Decision” is reached (an adequacy decision is the formal decision recognising that another country, territory or international organisation provides the same level of protection for personal data as the EU). This bridging period will allow personal data to continue have an unrestricted movement from the European Economic Area (EEA) to the UK until adequacy decisions are adopted. At present, the UK is requesting adequacy decisions for the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED).
For now, EU GDPR transfer rules will continue to apply to any data coming from the EEA into the UK unless the EU Commission makes an adequacy decision before the bridging period ends. Following the conclusion of the bridging period the EU GDPR will no longer apply to the UK as it is an EU Regulation, however you will still need to comply with UK data protection law. The UK GDPR has been integrated into UK data protection law and in theory there is little change to the core data protection principles, rights and obligations that organisations and businesses will be used to. In some instance the EU GDPR may still apply directly to your organisations if you operate in the European Economic Area (EEA), offer goods or services to individuals in the EEA, or monitor the behaviour of individuals in the EEA.
Businesses and organisations should also be aware that if you have an office, branch/other established presence, or customers in the EEA, you need to comply with both UK and EU data protection regulations and may need to designate a representative in the EEA. This person will be someone who offers services as a GDPR representative and will act as your local presence in the EEA, working with individuals and local supervisory authorities in that area. Organisations will need to update their privacy notice with the details of their EU Representative and advise the Local Supervisory Authority. Public authorities or those with occasional/low risk data transfers will not need to appoint a representative.
The Information Commissioners Office (ICO) have recommended that all businesses and organisations who receive personal data from the EEA to implement safeguards before the end of April, and not to wait until the bridging period ends. These safeguarding mechanisms are Standard Contractual Clauses and Binding Corporate Rules. Templates and information on both these are available on the ICO website. The latter however is mainly just for large multinational organisations and therefore will most likely not apply to much of the Voluntary and Community sector.
For more information, visit the ICO website where there is detailed guidance on Data Protection at the end of the transition period and International Transfers. The ICO have also produced an interactive tool on using standard contractual clauses for transfers into the UK.
Share Article...
NICVA Brexit Articles Timeline
Brexit and the impact on data transfer
19 Mar 2021Brexit and Your Rights webinar
10 Dec 2020Sustainable Development Goals Forum
26 Feb 2020NICVA's New Year's Round Up
6 Jan 2020A Common Purpose for Our Environment
19 Dec 2019Advice for Brexit Preparation
4 Oct 2019Brexit Updates and #NoToNoDeal
6 Sep 2019This is no time to suspend Parliament
28 Aug 2019Brexit, Boris and the Backstop: June Update
25 Jun 2019EU Settlement Scheme Explainer
13 Nov 2018What does a no-deal Brexit mean?
30 Aug 2018Department of Health Brexit update, July 2018
11 Jul 2018Dominic Raab appointed Brexit Secretary
9 Jul 2018June Brexit Update
27 Jun 2018May 2018 Brexit Update
15 May 2018The Latest on Brexit
15 Mar 2018Anniversary of Article 50 #5BrexitQs
6 Mar 2018Update on the EU Withdrawal Bill
19 Feb 2018UK-EU Brexit Deal…. What are the details?
11 Dec 2017Brexit case studies - can you help?
6 Oct 2017NICVA Position Paper on Brexit
24 Jul 2017Brexit Engagement: Justice
5 Jun 2017Five key messages as Brexit negotiations go live
29 Mar 2017Brexit – How will it affect you?
22 Feb 2017Brexit White Paper. Too Long; Didn't Read
3 Feb 2017Theresa May Brexit Speech – What did we learn?
18 Jan 2017First Brexit Roundtable with Secretary of State
16 Dec 2016Impact of Brexit and Rights on NI
14 Oct 2016Assembly Oral Questions on Brexit
10 Oct 2016NICVA meet with Minister for Exiting the EU
7 Oct 2016NICVA Update on EU Referendum.
1 Jul 2016Why is NICVA supporting In?
25 May 2016NICVA support remain position in EU Referendum
25 May 2016EU Referendum and the VCSE sector
18 Apr 2016
Subscribe to eNews
Share your COVID-19 support service
Organisations providing support to people and communities can share their service information here
Not a NICVA member yet?
Save time, money and energy. Join NICVA and you’ll be connecting in to a strong network of local organisations focused on voluntary and community activity.
Join UsNICVA now welcomes all small groups for free.