Disruption ahead for data flows

On Tuesday 6^th October 2020 the European Court of Justice (ECJ) made a ruling on data retention regimes in the UK, France and Belgium, which confirmed that national legislation on the collection of bulk communications data for national security agencies will need to be reformed to adhere to EU privacy rules. While this ruling does not specifically pertain to the UK-EU negotiations on a future relationship, it effectively confirms that significant disruption lies ahead for any UK company transferring data to the European Economic Area (EEA).

ADS has written previously about the importance of securing data adequacy status from the EU for UK businesses with cross-border data flows across Europe. Adequacy status is granted by the EU if the receiving country has adequate levels of protection for personal data. Up to 75% of the UK’s data transfers are with EU Member States and future restrictions on this would generate additional unwelcome costs for UK businesses. To date, the UK has been confident about obtaining this status given the current high level of alignment on legislative protections between the UK and EU.

The ECJ ruling now places the prospect of a positive data adequacy assessment for the UK potentially far out of reach. The UK’s Investigatory Powers Act would have to be reformed substantially, and in quick order, to meet the ECJ’s reservations and there is no indication from the UK Government that this will occur. The EU also holds concerns about the possibility of regulatory divergence by the UK in future. While there has been no final decision on data adequacy status for the UK it is now highly likely that data flows from the EU to the UK will face new restrictions after the end of the transition period.

It is for this reason that UK businesses should no longer delay in making alternative arrangements to maintain their cross-border data flows across Europe. There are several well-established transfer mechanisms, but the best option for most companies will be to put in place standard contractual clauses (SCCs) to avoid any interruptions.  To find out more please visit ADS’s Brexit Hub and the Information Commissioner’s Office website.