Withdrawal Agreement Data Transfer

Unless the Parties decide before 1 July 2020 to extend the transition period from 1 to 2 years, from 1 January 2021, all primary and secondary Union law will cease to apply to the United Kingdom. The transfer of personal data to the UK will then be subject to the requirements of Chapter V of the GDPR and the Law Enforcement Directive. The European Commission has published a series of communications setting out the implications in a number of policy areas to prepare citizens and stakeholders for the UK`s withdrawal. What happens to UK companies that process data in the EEA during the transition period? According to the EU GDPR, transfers of personal data from a controller/processor in the EU to a data recipient in a third country are generally prohibited unless the transfer is legitimised by a « data transfer mechanism » within the meaning of Chapter V of the EU GDPR. After the end of the Brexit transition period, the UK will be considered a « third country » and, therefore, companies transferring personal data to the UK will need to identify data transfer mechanisms that might be appropriate for their transfers from the EU to the UK. This data is referred to as « legacy data » in this news analysis. Article 71(2) shall not apply to Article 71(1) where the United Kingdom receives an adequacy decision from the Union. Art. 71 para. 3 provides that, where the United Kingdom loses its adequacy decision, it must, in the context of Article 71(1), apply protection to personal data which are `substantially equivalent` to the rules of EU law.

Article 71 is high-level and interacts with a complex web of the rest of the Withdrawal Agreement and various Brexit laws. Therefore, a number of aspects that can be applied in practice still need to be confirmed in subsequent legislation and guidelines. The « frozen GDPR » It is important to note that the data protection standards of Article 71 are not updated. For legacy data, the EU GDPR applies « in the version in force on the last day of the transition period » (this is the effect of Article 6(1) of the Withdrawal Agreement). This version of the EU GDPR is referred to in this article as « frozen GDPR ». The frozen GDPR must be interpreted in accordance with the relevant case law of the Court of Justice of the European Union adopted before the end of the transition period (see Article 4(4) of the Withdrawal Agreement). When interpreting the frozen GDPR, UK courts must « take due account of the relevant case law of the [Court of Justice] rendered after the end of the transition period » (see Article 4(5) of the Withdrawal Agreement). This means that previous case law on the EU GDPR, as well as cases issued after the end of the transition period, will be applicable when UK courts review the interpretation of the frozen GDPR. The implementation of the « frozen GDPR » in UK legislation Section 7A of the European Union Withdrawal Act 2018 (EU(W)A 2018) implements Section 71 of the Withdrawal Agreement. Article 7a is drafted in the same way as Article 2(1) of the European Communities Act 1972 (CEC 1972).

The 1972 European Court of Auditors, Article 2(1), allowed the EU`s GDPR to « transition » to UK national law without the need to legislate other implementing provisions. Similarly, Article 7A of the EU(W)A 2018 allows the application of the « frozen GDPR » in UK national law. In terms of hierarchy, the frozen GDPR takes precedence over the UK GDPR (see below). Indeed, the EU law applicable under the Withdrawal Agreement has the same legal effect in the United Kingdom as in the EU Member States (see Article 4(1) of the Withdrawal Agreement). This includes the principle of the primacy of Union law over national law. The primacy of the frozen GDPR over the UK GDPR is reflected in the drafting of EU(W)A 2018. The storage of the UK GDPR in accordance with Section 3 of EU(W)A 2018 is subject to the provisions incorporated by EU(W)A 2018, § 7A, including the frozen GDPR (see EU(W)A 2018, § 3(2)(a)(bi)). The frozen GDPR must be interpreted in accordance with the principles of EU law, including the primacy of EU law (see EU(W)A 2018, § 7C paras. 1 and 2). This means that the frozen GDPR applies to the processing of legacy data. In the event that UK national law (including the UK GDPR) and the frozen GDPR conflict, the frozen GDPR shall prevail.

Additional legislation will likely be needed to ensure that the frozen GDPR works properly in national law. The Uk Government will allow transfers to Gibraltar to continue. Alternatively, if you wish to continue receiving personal data from those countries or territories, you and the sender of the data should consider how to comply with local legal requirements for the transfer of personal data and seek local legal advice….