Taken from”The Legal Newspaper”, the legal information newspaper of the Wolters Kluwer Italia group and edited by Cedam, Utet Giuridica, Leggi d'Italia and Ipsoa.

THEcommercial cooperation agreement signed on 24.12.2020 between the European Union and the United Kingdom includes a section dedicated to Data protection in which there are significant transitional provisions on data transfer. These provisions must be evaluated in combination with the European regulatory framework of reference and the case law of the Court of Justice of the European Union in the recent ruling on the so-called case. Schrems II.

What does the Data Protection Agreement provide

Parts 6 and 7 of the Agreement establish important provisions on data protection.

First, the EU and the UK declare that they are mutually committed to maintaining high data protection standards.

With regard to the delicate issue of the transfer of personal data, starting from January 1, 2021, there is a provisional period of up to 6 months (the default period is 4 months and will be automatically extended by another two months if necessary, unless the United Kingdom or the EU unilaterally objects) in which transfers of personal data from the EEA to the United Kingdom will be free, as the United Kingdom is not considered a 'third country' under EU law. This means that when transferring from here the restrictions on the transfer of personal data under Chapter V will not apply of the General Data Protection Regulation (hereinafter “GDPR”).

This is an important aspect that prevents companies and other organizations from need to work quickly and furiously to prepare the appropriate documentation to justify the lawfulness of the data transfer.

However, the EU has placed the United Kingdom at the expense of Two conditions for the application of this Grace Period:

(i) Prohibition to amend laws on data protection with respect to the regulatory framework in force on 31 December 2020 (except for the need to align with EU legislation);

(ii) prohibition to exercise certain 'designated powers' ['designated powers' that the UK must exercise only with the consent of the EU during the interim period include [on this point cf. Part VII, art. FINPROV)] relating to international transfers without EU agreement, including, for example, the power for the English Data Protection Authority (ICO) to publish standard contractual clauses for international transfers of personal data from the United Kingdom and to approve new codes of conduct and certification mechanisms or binding business rules that can be relied on to carry out international transfers of personal data.

Failure to comply with even one of these conditions would result in the automatic termination of the provisional period.

The provision of these conditions should be interpreted as the guarantee required by the EU to prevent the United Kingdom from becoming the gateway for transfers of personal data to third countries.

The full article is published in ”The Legal Newspaper”

‍