UK prioritises US data transfers agreement

The UK has announced that it is prioritising the agreement of several new “data adequacy partnerships”, including with the US, as a means of bolstering international trade.

Similar agreements with Australia, the Republic of Korea, Singapore, the Dubai International Finance Centre and Colombia are also being prioritised, and the government said its longer-term priority is to secure future partnerships with India, Brazil, Kenya and Indonesia too.

The Department of Digital, Culture, Media and Sport (DCMS) said: “Estimates suggest there is as much as £11 billion worth of trade that goes unrealised around the world due to barriers associated with data transfers. The aim is to move quickly and creatively to develop global partnerships which will make it easier for UK organisations to exchange data with important markets and fast-growing economies.”

Both UK and EU data protection law impose strict conditions on the transfer of personal data outside of the jurisdiction. Legal tools such as standard contractual clauses can be implemented into data processing agreements to require importers to handle the personal data being transferred to them in line with data protection standards in the exporter’s jurisdiction. However, adequacy agreements can negate the need for SCCs and other legal tools to be implemented.

Adequacy agreements are a formal means of recognising that personal data exported from one jurisdiction to another will be subject to comparable data protection standards in the country where the importer is based. Once such an agreement is in place, organisations can transfer personal data freely to the importing countries so long as those data transfer arrangements are aligned to the terms of the adequacy agreement.

When the UK was an EU member state it benefited from the adequacy decisions reached by the European Commission. Organisations in the European Economic Area (EEA) are able to transfer personal data to a raft of countries, including the UK, Canada, Switzerland and New Zealand, by virtue of the adequacy decisions the Commission has put in place.

The UK, with this latest announcement, has signalled its intention to increase the existing adequacy decisions that the government has taken since Brexit. The decisions taken to-date support the free flow of personal data from the UK to 42 jurisdictions, including each of the 27 EU member states.

In new guidance on the UK’s approach to international data transfers, DCMS said: “UK adequacy is the most efficient way to freely transfer personal data as it removes the need for UK organisations to use alternative transfer mechanisms, which can be costly to implement. Adequacy can also provide consumers and organisations greater certainty and confidence in the regulatory landscape of another country.”

The government’s plans in relation to bolstering international data transfers also include the formation of a new International Data Transfers Expert Council. The body, to be comprised of experts from academia, industry and civil society, is to advise the government on championing international data flows, DCMS said. Applications for the 15 positions available on the council are now being taken.

DCMS has separately outlined plans to reform the UK data protection regime. It said a consultation will be opened on the matter in the weeks ahead.