UK-US ‘data bridge’ to complement EU-US ‘Privacy Shield 2.0’

The new “data bridge” would be an extension of the EU-US Data Privacy Framework, dubbed ‘Privacy Shield 2.0’. The government said it would “make it easier for around 55,000 UK businesses to transfer data freely to certified US organisations without cumbersome red tape” and deliver annual savings to business of around £92.4 million

The European Commission has signalled its intention to adopt an adequacy decision in respect of the EU-US Data Privacy Framework. That framework has been developed after its predecessor, the EU-US Privacy Shield, was invalidated by a ruling of the EU’s highest court. The UK-US data bridge, when finalised, would constitute a UK-issued adequacy decision.

“A data bridge would avoid the need for businesses to utilise costly and inefficient alternative transfer mechanisms, such as individual contractual clauses, when transferring personal data,” said the UK government, which intends to consult the Information Commissioner’s Office (ICO), the UK’s data protection authority, on the UK-US data bridge.

Data protection law expert Rosie Nance of Pinsent Masons said: “This announcement provides more certainty on what the framework for data flows between the US and the UK will look like. We now have confirmation that there will be a UK extension to the Data Privacy Framework between the US and EU, similar to the Swiss-US Privacy Shield under the previous framework.”

The UK and US had announced “significant progress towards a data adequacy agreement” when president Joe Biden signed an Executive Order in relation to the framework in October 2022.  Nance said, however, that there was no confirmation at that stage on what form the adequacy agreement could take.

Nance said: “An agreement with broader scope that the EU-US agreement could potentially have threatened the UK’s EU adequacy status. A UK extension to the Data Privacy Framework is the most streamlined approach to take, it is likely to be the smoothest approach for reaching political agreement. It is also the least likely to cause issues for the UK’s own EU adequacy status, as the UK approach will presumably align with the EU’s.”

The announcement of the new UK-US data bridge forms part of a broader ‘Atlantic Declaration’ agreed by US president Joe Biden and UK prime minister Rishi Sunak, which includes a commitment to step up international efforts to ensure the safe and responsible development of artificial intelligence (AI) systems.