EU: Commission addresses data transfers and adequacy after Brexit, recommends practical steps for businesses
The European Commission ('the Commission') announced, on 9 July 2020, that it had issued a Communication on Readiness at the End of the Transition Period between the European Union and the United Kingdom ('the Communication'). In particular, and in relation to data transfers, the Communication provides that, as of 1 January 2021, transfers of personal data to the UK can continue, but they will have to comply with specific EU rules and safeguards relating to the transfer of personal data to third countries, as set out in the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). Moreover, the Communication provides that the EU will use its best endeavours to conclude the assessment of the UK regime by the end of 2020, with a view to possibly adopting an adequacy decision, if the UK meets the applicable conditions.
Furthermore, the Communication advises businesses to take the necessary steps to ensure the compliance of any personal data transfers to the UK with EU data protection law, irrespective of the scenario whereby an adequacy decision will be taken. In this regard, the Communication recalls that compliance can be achieved by having appropriate safeguards in place, including Binding Corporate Rules ('BCRs'), or through specific derogations.