EU issues an update on Brexit talks and adequacy issues
A communication of 9 July from the European Commission says that the ‘EU will use its best endeavours to conclude the assessment of the UK regime by the end of 2020 with a view to possibly adopting a decision if the United Kingdom meets the applicable conditions. The Commission is currently conducting this assessment and has held several technical meetings with the United Kingdom to gather information in order to inform the process. On the side of the United Kingdom, its Data Protection Act conferred adequacy on EU Member States until the end of 2024, with the need to be re-examined by that date.’
If there is no adequacy decision, organisations will have to resort to using Standard Contractual Clauses or Binding Corporate Rules (BCRs). On 6 July, the Commission issued an update on the data transfer situation. In this reminder of the legal situation, the Commission says that BCRs approved by the UK ICO since 25 May 2018 ‘no longer provide appropriate safeguards after the end of the transition period, unless these binding corporate rules are subject to a new approval from a competent authority of an EU Member State confirming that they provide appropriate safeguards for international transfer of personal data after the end of the transition period.’
The European Data Protection Board (EDPB) will soon publish an Information note addressing specifically how to deal in practice with BCRs approved by the ICO, the Commission says.
See:
- European Commission - Notice to Stakeholders
- European Commission - Communication on readiness at the end of the transition period between the European Union and the United Kingdom
Follow Privacy Laws & Business UK Report for more news and analysis on this topic.