On 28 June 2021, the European Commission formally adopted an ‘adequacy decision’ that permits the continued free flow of personal data from EEA countries to the UK under the EU General Data Protection Regulation (EU GDPR).   This is pleasing news and no doubt a relief to many HR practitioners with international employees across both the UK and EEA.

HR Optimisation summarises what this means for UK employers:

Legal Context

The EU GDPR regulations restricts international transfers of personal data outside the EEA on the basis that other countries may not offer a sufficient level of data protection. Restricted transfers are only permitted if the country or territory to which the data is transferred has received an ‘adequacy decision’ from the EU Commission, additional safeguards such as standard contractual clauses or binding corporate rules are put in place, or an exception applies.

Restrictions on international transfers have the potential to interrupt data flows and be disruptive to business. For example, employers that are part of a multinational corporate group with companies in the UK and across the EEA, operating a centralised HR portal, are constantly sending and receiving personal data across borders.

Brexit and the Trade and Cooperation Agreement

Subsequent to the post-Brexit transition period ending on 1 January 2021, the UK has been a third country for the purposes of transfers of personal data from the EEA to the UK. The UK-EU Trade and Cooperation Agreement provided a bridging mechanism that allowed the continued free flow of personal data from the EEA to the UK after the transition period for up to 6 months, i.e. up to 30 June 2021, while the EU Commission considered whether to grant the UK an adequacy decision.

Affirmative for Adequacy Decision

Thankfully common sense prevailed and on 28 June 2021 and adequacy decision was granted by the EU Commission for an initial 4 year period.   Accordingly, it remains possible for personal data to be transferred from the EEA to the UK without additional safeguards.

What of transferring personal data from the UK to the EEA?

The substance of the EU GDPR has been incorporated into UK domestic law and continues to apply, albeit with certain changes to take account of Brexit. This is referred to as the ‘UK GDPR’ and is supplemented by the Data Protection Act 2018 (DPA 2018).

In much the same way as the EU GDPR restricts transfers of personal data outside the EEA, the UK GDPR restricts transfers of personal data outside the UK. However, in the lead up to the end of the post-Brexit transition period, the UK Government recognised EEA member states as providing adequate protection for personal data, in order to ensure the continued free flow of personal data from the UK to the EEA without the need for additional safeguards.

Action:  Data protection documentation such as employee and customer privacy notices should, however, identify that personal data is being transferred on this basis (from UK to EEA and vice versa) where this applies to your business.