Following the United Kingdom’s exit from the EU, the Information Commissioner’s Office (ICO) is close to developing the UK’s own standard contractual clauses for international data transfers under the UK General Data Protection Regulation (UK GDPR) (the UK’s adaptation of the EU’s General Data Protection Regulation (EU GDPR)).
Recently, the ICO deputy commissioner for regulatory strategy, Steve Wood, in an online Data Protection Practitioners’ conference said:
“The ICO is working on bespoke UK standard clauses for international transfers, and we intend to go out for consultation on those in the summer.”
The standard contractual clauses release is highly anticipated given that it is likely to be the most used transfer tool for UK organisations under the UK GDPR.
In his speech, Wood, also stated that the UK is considering how it will approach the need for a UK-US data transfer agreement, and that “the ICO will continue to provide regulatory advice on that”. It is likely that the UK’s approach will mirror the European Commission’s revised standard contractual clauses (expected soon) written following the annulment of the ‘EU-US Privacy Shield’ mechanism. The revised version of the EU standard contractual clauses will give organisations greater legal certainty, particularly, where EU to US data transfers are taking place.
Data adequacy
The conference also touched upon the pending data adequacy position for the UK. Wood was optimistic that the UK will soon receive a final EU adequacy decision for data transfers under the EU GDPR. Wood hopes that the process will be completed in the coming months. It is understood that the decision will be based on an “essential equivalence” test, meaning, “the UK does not have to maintain a carbon copy of the EU law” said Wood.
Additionally, it was mentioned that the UK aims to expand the list of jurisdictions that it will consider as “adequate”, subject to a four-stage process:
- Gatekeeping;
- Assessment;
- Analysis; and
- Procedural review.
The ICO will be involved in all of the stages and will publish its own opinion under the final stage (four). It is expected in June that the Department for Digital, Cultural, Media and Sport will make an announcement regarding the new jurisdictions that the UK will aim to negotiate data adequacy agreements with.
How can Nelsons help?
Post-Brexit data protection is a developing area of law, which organisations need to understand and comply with – particularly in relation to cross-border international transfers. If you would like any assistance, please contact Emma Toes (née Ward), Partner in our expert Commerce & Technology team, on 0800 024 1976 or via our online enquiry form.