Transfers of personal data would have become “Third country transfers” at the end of the Transition Period
On 31.01.2020 the UK left the European Union but for a Transition Period of 11 months set forth in the „Withdrawal Agreement“ the UK was not treated as third country with respect to the processing of personal data. Enterprises did not have to take additional measures as required by Art. 44 ff. GDPR but could treat such data transfers like those within or between EU member states. This Transition Period was set to expire at the end of 31.12.2020. In preparation of this event many enterprises moved servers from the UK to the EU and modified their processes or prepared Standard Contractual Clauses to ensure an adequate level of data protection between the EU and the UK. The recent Schrems-II decision by the Court of Justice of the European Union raised additional questions, in particular if the mere conclusion of Standard Contractual Clauses would suffice to ensure an adequate level of data protection.
Extension of Transition Period
The Draft EU-UK Trade and Cooperation Agreement published over Christmas now provides for an additional transition period, the „Specified Period“ during which the UK will be treated with respect to processing of personal data like a EU member state. This grants another respite to enterprises who had not yet fully prepared for a No-Deal-Brexit or any Brexit for that matter: Provided that data protection legislation of the UK continues to apply as it does on 31.12.2020, transmission of personal data from the EU to the UK shall not be considered as transfer to a third country under EU law for four months. This period shall be extended by two further months, unless the EU or the UK object. The draft does not state when this objection needs to be raised.
Waiting for an adequacy decision
The Specified Period can be replaced if adequacy decisions in relation to the UK are adopted by the European Commission (under Article 36(3) of Directive (EU) 2016/680 and under Article 45(3) of Regulation (EU) 2016/679). That means also that an adequacy decision is not part of the Brexit deal. Any adequacy decision will be taken unilaterally by the European Commission. The European Commission had hinted in early 2020 that it was preparing to issue such an decision by the end of the initial Transition Period (by 31.12.2020). It is unclear if the now agreed respite of another 6 months gives any hint as to the timeline for the adequacy decisions. However, the European Commission will now in any case have to consider the implication of the Schrems II decision. The UK has already decided that transfers of personal data from the UK to the EU are treated like transfers within the UK.
The EU member states and the UK have not yet ratified the last-minute EU-UK Trade and Cooperation Agreement. With that in mind, a no-deal brexit which would make the UK a third country for transfers of personal data under GDPR ( with the requirements of Art. 44 ff. GDPR), is still possible.
