ICO launches consultation on data transfers outside of the UK

The Information Commissioner’s Office (ICO) is currently consulting on its draft International Data Transfer Agreement (IDTA) and guidance. The IDTA will replace the current Standard Contractual Clauses (SCCs) and can be used for transfers to countries that are not considered adequate.

A replacement for SCCs was needed to take into account the implications of the Schrems II judgement of the Court of Justice of the European Union. The EU issued its own revised SCCs in June.

The ICO consultation is split into three sections:

  • Proposal and plans for updates to guidance on international transfers.
  • Transfer risk assessments.
  • The international data transfer agreement.

Steve Wood, ICO Executive Director of Regulatory Strategy, said:

“We understand that international transfers can be complex, especially for smaller businesses. Our new guidance has been designed to be accessible and to ensure they support all organisations, from SMEs without the benefit of large legal budgets to multi-national companies. The agreements will help organisations to continue to trade freely while ensuring the correct protections are in place before transferring people’s data.”

The consultation, which is open until 7 October, will feed into the ICO’s work on the final IDTAs. The ICO is required to lay the final documents before Parliament.

See: ICO consults on how organisations can continue to protect people’s personal data when it’s transferred outside of the UK

We will publish an analysis of the draft IDTAs in next PL&B UK Report by Emma Erskine-Fox of TLT LLP.