July 20, 2020

The Notice reminds stakeholders that after the end of the transition period, the transmission of data from the EU to the UK will be a “transfer” under Chapter V of the GDPR (2016/679/EU), i.e. it will be a transfer to a third country. Aside from the possibility of an “adequacy decision”, the GDPR provides for the possibility of transfers on the basis of “appropriate safeguards” and “derogations”.

“Appropriate safeguards” include standard data protection clauses adopted by the EU Commission and binding corporate rules, which require the approval of the relevant EU supervisory authority. However, binding corporate rules approved by the UK supervisory authority (i.e. the ICO) since 25 May 2018 will no longer provide appropriate safeguards after the end of the transition period, unless they are subject to a new approval from the competent authority of an EU Member State.

Binding corporate rules approved before 25 May 2018 by the UK supervisory authority can only continue to be used if any connection to the legal order of the UK, such as the corporate entity designated, the competent courts or the competent supervisory authority, is replaced by equivalent roles for corporate entities and competent authorities within the EU.

As for derogations, under Article 49 of the GDPR, in the absence of an adequacy decision or of appropriate safeguards, a transfer can take place under a derogation which allows transfers in specific cases, such as on the basis of consent, for the performance of a contract, for the exercise of legal claims or for important reasons of public interest.

Article 71(1) of the Withdrawal Agreement provides that the personal data of data subjects outside the UK, where the data were transmitted to the UK or otherwise processed in the UK before the end of the transition period, or were transmitted to the UK or otherwise processed in the UK after the end of the transition period on the basis of the Withdrawal Agreement, can continue to be processed in the UK after the end of the transition period.

This is to ensure the continued protection of personal data of data subjects whose personal data were transmitted to the UK while it was a Member State and during the transition period. It also ensures the continued protection of personal data of data subjects outside the UK processed in the UK on the basis of the Withdrawal Agreement after the end of the transition period. To read the Notice in full, click here.