Government announces ‘outcomes-based’ approach to granting UK GDPR data adequacy status to countries prioritised as International Data Partners

Joanne Bone, who advises organisations across all sectors on data protection and privacy,  looks at the UK government’s recently announced Mission Statement on International Data Transfers.

After the tension of June wondering if the EU Commission would grant the UK data adequacy status and enable personal data between the EU and the UK to flow uninterrupted, we now have the tension of wondering what effect the latest announcement from Oliver Dowden MP, Minister for the Department for Digital, Culture, Media & Sport (DDCMS) will have on this adequacy decision. GDPR watchers will remember that the Decision was subject to reservations by the European Parliament including in relation to onward transmission from the UK following the announcement back in March that the DDCMS would be developing a UK Data Adequacy Framework of its own. Last week’s announcement put flesh to the bones of that announcement with the release of a Mission Statement detailing the UK’s future plans for international data transfers and mapping out how the process for the granting of UK data adequacy status would work.  It made it clear that there will be priority countries with whom we wish to form ‘international data partnerships’ and that these partnerships will be pursued on ‘an outcomes-based’ approach.  These countries will be recognised as adequate for the purpose of transferring personal data to from the UK.

And although fashioned as an ‘unveiling’, the UK government’s intention to expand the list of adequate destinations in line with its own views on which meet “the UK’s commitment to high standards of data protection” has hardly been a secret.  Countries to be included in the first wave of UK adequacy decisions are stated to be the US, Australia, the Republic of Korea, Singapore, the Dubai International Finance Centre and Colombia. These will probably be followed by India, Brazil, Kenya and Indonesia.  Whilst the Republic of Korea is also scheduled soon to get an EU adequacy decision the other countries are most likely there as the UK Government sees adequacy as working “hand in hand with the UK’s trade agreements” and to “support the country’s ambitious trade agenda”. 

In view of the issues relating to the export of personal data to the US arising from the Schrems II decision in July 2020 it will be interesting to see what the EU Commission’s reaction to the DDCMS statement is and whether it looks to get further assurances that EU data will not go to the US via the UK as a result of any UK/US adequacy decision.  More worryingly, it may even take further action.  As Věra Jourová from the Commission said at the time UK adequacy was granted “if anything changes on the UK side, we will intervene”. On Thursday, a Commission spokesperson confirmed,

"In case of problematic developments that negatively affect the level of protection, the adequacy decision can be suspended, terminated or amended at any time by the Commission."

I recently spoke about how to navigate the minefield of exporting personal data (catch up here) and have previously covered practical consequences for businesses on the loss of the US Privacy Shield following Schrems II (catch up here). This development will now also have to be factored in by businesses.

What does the government’s announcement mean for business?

It’s good news for businesses trading with or registered in countries prioritised by the UK for being granted data adequacy status as it will mean an easier way to keep personal data flowing between the relevant countries.

What will not be helpful is if the EU Commission react to some of the decisions in a way that makes the flow of personal data from the EU to the UK harder.

One other thing worth bearing in mind if adequacy is not granted to a country and standard export clauses need to be put in place, is that the ICO is consulting on what the UK standard clauses should look like. The Consultation on Standard Contractual Clauses ends on 7 October and the International Data Transfer Toolkit is anticipated to be in place by the end of 2021. 2021 has so far been an eventful year for data protection and the rest of the year and into 2022 is shaping up to be as eventful.

Businesses will want to keep an eye on how best to navigate data export issues at an organisational and global level.

Irwin Mitchell's GDPR and Data Protection team are available to advise. 

"In case of problematic developments that negatively affect the level of protection, the adequacy decision can be suspended, terminated or amended at any time by the Commission."”