Clarkslegal LLP - Solicitors in Reading and London

Legal Updates

6 more months of UK-EEA free flow of Data

11 January 2021 #Data Protection #Brexit

“This is the best possible outcome for UK organisations processing personal data from the EU” stated Information Commissioner, Elizabeth Denham.

The Commissioner was reacting to confirmation, included in the UK-EU Trade and Cooperation Agreement (the “Agreement”), that the EU will continue to allow personal data to flow freely between the European Economic Area and the UK. This will come as a great relief to many organisations with European offices or parties to UK-EU relationships that require the free and uninterrupted flow of personal data.

There is, however, one key caveat. This temporary allowance for the free flow of data will only continue for a maximum period of 6 months (4 months from the date of the agreement with the option to extend for a further two unless one party objects) or until the UK is granted an adequacy decision by the European Union.

In short, an adequacy decision is a safeguarding mechanism issued by the European Commission to countries outside of the European Economic Area. The decision acts as a means of certification that the awarded country has the appropriate level of personal data protection in place; a level of protection that must be similar to the protections outlined in the EU’s General Data Protection Regulations (the “GDPR”).

Whether or not an adequacy decision will be granted is by no means guaranteed. It had been previously hoped that even if the UK was not granted an adequacy decision, organisations could rely on Standard Contractual Clauses to facilitate the transfer. However, the decision in Schrems II has emphasized that these may not be suitable unless onward transfers of personal data are also adequately protected. The US, amongst other countries, is known to have more controversial local surveillance laws and it would appear that the EU remains very concerned about the extent to which a country’s law enforcement and public authorities can access a resident’s data.

The Agreement also stipulated that the UK will not change its current data protection laws, from those in circulation as at 31 December 2020, during the 6 month period. However, changes may come after once this period has lapsed; we would advise all organizations to continue to keep abreast of any further announcements by the ICO.

Read the ICO’s full statement 

This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.

Read more articles

Jacob Montague

Jacob Montague

T: 0118 960 4613
M: 0790 9964 585


Data Protection team
+44 (0)118 958 5321