New UK-US data bridge for transfers of personal data
- 30 October 2023
- Privacy and Data Protection
A new data bridge, which is an extension of the EU-US Data Privacy Framework (“the DPF”), will enable UK businesses to transfer personal data to certified US organisations without the requirement of having the usual safeguards in place or performing a transfer risk assessment. This data bridge came into force on 12 October 2023.
On 10 July 2023, the European Commission adopted an adequacy decision in respect of the DPF where US businesses could certify themselves with the DPF which would involve such businesses having to comply with similar provisions as set out in the GDPR. Provided such measures are in place where the US organisation is then publicly placed onto the Data Privacy Framework List (“DPF List”), this would then enable transfers of personal data to be freely made between the EU and US without the need for businesses to adopt usual safeguards and undertaking a transfer risk assessment.
The UK Government then later published the Data Protection (Adequacy) (United States of America) Regulations 2023 for the UK Extension to the EU-US Data Privacy Framework. These regulations state that the US is an “adequate country” for data transfer purposes from the UK, under the UK GDPR and Data Protection Act 2018.
This data bridge should result in personal data transfers between the UK and the US being less time-consuming and burdensome for businesses, however where this has only recently been implemented, some caution should be taken if businesses seek to rely on this data bridge. For example, there has been discussion of challenge which could affect the validity of the data bridge. It has only recently been implemented so some time will be required to test its validity. It may be best for organisations to consider some “back up” processes, for example, having the Standard Contractual Clauses or International Data Transfer Agreement in place, in case the DPF is removed.
This data bridge should result in personal data transfers between the UK and the US being less time-consuming and burdensome for businesses.
A fact sheet has been issued by the Department for Science, Innovation and Technology (“DSIT”) which includes the following key points:
If organisations wish to rely on this data bridge, we would recommend that the following steps are taken:
If you any advice in relation to international data transfers, please do not hesitate to contact our data protection lawyers.
Keep up to date with the latest tips, analysis and upcoming events by our legal experts, direct to your inbox.
Disclaimer
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.