- 30 August 2022
- Privacy and Data Protection
There have been many developments relating to how data flows are governed, ranging from the standard contractual clauses (SCCs) to the notable Schrems II decision; following this, the UK was deemed an ‘adequate’ country by the EU in respect of personal data transfers. Earlier this year, the Secretary of State laid before Parliament the International Data Transfer Agreement (IDTA), the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum) and a document setting out transitional provisions. In a post-Brexit world, the UK has also explored a data protection reform bill to reshape its approach to regulation outside of the EU. So, where are we now with the UK data protection regime and what should organisations look out for?
What is the IDTA and how does it work?
The UK’s independent data protection regulator, the Information Commissioner’s Office (ICO), prepared the IDTA, which came into force on 21 March 2022. Where UK-based organisations will export personal data to third countries (such as the USA), which are not covered by an adequacy decision, they will be able to choose between the IDTA and the Addendum to transfer personal data outside the UK. This will depend on whether the personal data is solely being exported by the UK (where the IDTA would be appropriate), or both the UK and the EEA (where the Addendum would be appropriate, particularly for global organisations). The ICO has provided further guidance on what restricted transfers are in its ‘Guide to the UK General Data Protection Regulation (UK GDPR)’. In general terms, the IDTA contains mandatory clauses which the data importer and exporter will need to comply with, but also provides the opportunity to refer to other data processing and data sharing agreements the parties may have in place.
What are the key dates to look out for?
It is important to note that contracts concluded on or before 21 September 2022 on the basis of the old EU Standard Contractual Clauses (EU SCCs) can remain in place unchanged and will provide adequate safeguards until 21 March 2024, where the data being transferred is only being exported from the UK.
However, for new contracts for data transfers from the UK entered into after 21 September 2022, the UK Addendum to the new EU SCCs or the IDTA will need to be used, though new contracts have been able to adopt these since the IDTA had come into force from 21 March 2022.
Following the UK’s adequacy decision, we see the UK move away from the EU’s approach on data protection to adopt and focus on a risk-based approach with the aim of reducing administrative burdens and supporting economic growth.
What next steps should organisations take?
With these dates in mind, and when considering whether to enter into an IDTA, organisations, particularly in light of any company restructures, mergers or takeovers, should now seek to understand their data flows, particularly in terms of whether there are data flows between the UK, the EEA and/or third countries or if the nature of the processing has changed.
Organisations will then need to undertake a transfer risk assessment to better understand the safeguards and security requirements they will need to implement to protect the personal data.
Importers and exporters will need to be clear on the types of personal data that will be transferred, data subjects, security requirements and any extra protections and safeguards arising from transfer risk assessments. The IDTA considers other separate “linked agreements” in which data importers and exporters will need to consider if such data processing or data sharing agreements includes all the personal data and data flows involved, with consideration to the requirements and terminology in the UK GDPR. For example, it may be that such linked agreements need to be updated to be compliant with the UK GDPR or if the processing of the personal data has changed since the parties entered into a new agreement for services.
In the meantime, we await further guidance on the transfer risk assessment and will monitor how the increasing use of the IDTAs and Addendums will shape the data protection landscape.
Overall, this has been a crucial year for data protection in which, following the UK’s adequacy decision, we see the UK move away from the EU’s approach on data protection to adopt and focus on a risk-based approach with the aim of reducing administrative burdens and supporting economic growth. However, a crucial aspect will be to see whether any further changes to the data protection regime by the UK could risk the UK’s adequacy decision being impacted.
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.
Read, listen and watch our latest insights
- 22 September 2023
Talking Employment Law: New family friendly rights
In this first podcast in the ‘Talking Employment Law’ series, Lucy Densham Brown and Rebecca Dowle, members of the employment team summarise some of the big new family-friendly Bills that are working their way through parliament.
- 20 September 2023
- Commercial Real Estate
Commercial buyers beware of residential Stamp Duty Land Tax
This article discusses a recent case in which a property buyer calculated the Stamp Duty Land Tax due on the purchase at a lower rate, due to the mixed-use purpose of the property.
- 19 September 2023
- Privacy and Data Protection
Organisations’ use of social media: Data protection
Social media applications (or commonly known as ‘apps’) are being developed all the time and we are constantly being introduced to new social media platforms, some of which take almost no time to gain huge popularity.
- 14 September 2023
Entrepreneurial Dreams: What is the Innovator Founder Visa?
In an era defined by innovation and entrepreneurship, the United Kingdom has made a substantial effort towards fostering its reputation as a global hub for start-ups and innovators. The introduction of the UK’s ‘Innovator Founder’ route has marked a pivotal moment in the country’s immigration policy.
- 11 September 2023
- Corporate and M&A
Changes to the tax treatment of Employee Ownership Trusts
The government published a consultation on 18 July 2023 seeking the public’s views on its proposals to reform the tax treatment of Employee Ownership Trusts and Employee Benefit Trusts. Parties are invited to express their opinions via email via the government website until the consultation closes on 25 September 2023.