Data transfer news

On Friday 28 January 2022, the Department for Culture, Media and Sport (DCMS) laid the following documents before Parliament:

• International Data Transfer Agreement (IDTA)
• International Data Transfer Addendum to the European Commission’s standard contractual clauses (the Addendum)
• Document setting out transitional provisions as to the use of the current standard data protection clauses for international transfers

This is a significant development for organisations that do, or intend to, transfer personal data outside of the UK.

The IDTA and Addendum are a new set of standard contractual clauses which will replace the EU standard contractual clauses currently being used to facilitate international transfer of personal data, and the IDTAis part of the wider UK package to assist international transfers.

The background

The UK GDPR prohibits transfers of personal data outside of the UK (a Restricted Transfer). Under the UK GDPR, organisations within the UK (Exporters) cannot make a Restricted Transfer unless:

• the DCMS has made an adequacy decision for the relevant country that allows transfer of personal data to that country (Article 45 of the UK GDPR). There are currently adequacy decision in place for the member states of the European Union, member states of EFTA, Gibraltar, Andorra, Argentina, Faroe Islands, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and; Uruguay; or
• if there is no adequacy decision for the relevant country, there is an appropriate safeguard in place as set out in article 46 of the UK GDPR. One such safeguard set out in article 46 of the UK GDPR is that Exporters may use standard data protection clauses issued by DCMS pursuant to section 17C of the Data Protection Act 2018.

The current position and ICO consultation

Currently, UK data exporters continue to rely on the standard contractual clauses issued by the European Commission back in 1995 (the Old EU SCCs).

Whilst the EU published new standard contractual clauses in 2021 (the New EU SCCs), these are not in force in the UK as they were published post-Brexit.

The Addendum – what is it and when to use it?

In addition to the IDTA, the DCMS have also published the Addendum which is an alternative options to the IDTA and designed to work alongside the New EU SCCs so as to make them work in the context of Restricted Transfers from the UK. These may, in particular, be attractive to multi-national Exporters who are familiar with the New EU SCCs and routinely use these (such as pan-European organisations who have a presence in the UK but transfer data from the UK and outside the EU).

Again the ICO deem that the provisions of the Addendum together with the New EU SCCs contain appropriate safeguards for the transferred data and are another potential options to be used when Exporters wish to perform a Restricted Transfer to a recipient country which does not benefit from an adequacy regulation and are entered into by the Exporter and the recipient organisation.

Beware! The IDTA or Addendum alone will not suffice – risk assessment

The European Court of Justice’s judgment in Schrems II stated that relying on standard contractual clauses such as the EU SCCs or the IDTA alone would not be enough to ensure adequate protection when performing a Restricted Transfer. Whilst a judgment of the ECJ, it remains binding on the UK. Therefore, before making a Restricted Transfer Exporters must also consider the legal context in the recipient country and make an assessment of the level of protection provided by the standard contractual clauses (such as the IDTA) in the destination country. Where the laws of the destination country (or state) do not provide adequate protection, the use of the IDTA is not enough, and the data exporter must not transfer the data.

When consulting on the IDTA, the ICO also consulted on a Transfer Risk Assessment Tool (TRA) and produced a draft TRA to assist Exporters in their risk analysis. Following the consultation, neither the ICO nor DCMS have confirmed whether the TRA will be published and further news is awaited (although there is no requirement for this document to be laid before Parliament and therefore it may well be the case that the TRA will be published due course).

What next?

On the assumption that there is no Parliamentary objection to the documents (which we believe to be unlikely given Parliament has other priorities at the moment), the documents will lay before Parliament for a period of 40 days after which they will come in to force on the 21 March 2022. However, the ICO state that the documents are “immediately of use to organisations transferring personal data outside the UK, subject to the caveat that they come into force on the 21 March 2022.” This suggests that Exporters can start to use the IDTA immediately.

The DCMS have also published transitional provisions that provide guidance as to Exporters’ transition from the EU SCCs to the IDTA. In short, this means that where an Exporter seeks to rely on standard contractual clauses for Restricted Transfers:

• where contracts for the Restricted Transfer are concluded on or before 21 September 2022, the Exporter may rely on either:
  • the Old EU SCCs but must replace the EU SCCs with the IDTA before the 22 March 2024;
  • the IDTA; or
  • the Addendum and New EU SCCs;
• where contracts for the Restricted Transfer are concluded after 21 September 2022 the IDTA or the Addendum and New EU SCCs must be used.

Key points

• Consider and map out your current and proposed future international data transfers – where are you transferring to (e.g. does the country benefit from a adequacy regulation or not) and do you have a lawful basis under the UK GDPR to perform the international transfer
• For international data transfers to countries which do not have an adequacy decision, do you need to undertake an analysis of the legal context in the recipient country and make an assessment of the level of protection provided by the standard contractual clauses (such as the IDTA) in the destination country?
• Consider the contractual arrangements you have in place and will need in place in the future
• Do you currently use the Old EU SCCs? If so, you will need to consider and plan future arrangements, including whether to move on to the IDTA or the Addendum and New EU SCCs

How Blake Morgan can help

Our data protection experts work with business and organisations to help them navigate these issues. Should your organisation suffer a data breach, then Blake Morgan’s expert data protection lawyers can assist with your response – from determining whether the breach needs to be reported to the ICO or notified to data subjects and practical steps to take in response to the breach to dealing with claims for compensation as a result. Contact us at [email protected] for specific advice and support.