UK: DCMS unveils post-Brexit global data plans, including approach to international data transfers and UK adequacy
The Department for Digital, Culture, Media and Sport ('DCMS') released, on 26 August 2021, a package of measures to help the UK seize opportunities of data to post growth, trade, and improve its public services. Among other things, the plans include:
- the UK Adequacy Manual Template for undertaking adequacy assessments, as well as guidance for the UK manual and a map illustrating priority countries;
- a mission statement, namely guidance titled International Data Transfers: Building Trust, Delivering Growth and Firing Up Innovation ('the IDT Guidance'), outlining the UK's approach to adequacy assessments and international data transfers;
- naming New Zealand Privacy Commissioner John Edwards as the preferred new Information Commissioner;
- a call for experts to form a new International Data Transfers Expert Council to inform and consult on the UK's international data transfers policy; and
- launching a consultation shortly on increasing trade and innovation through the UK data regime.
In particular, the DCMS confirmed that its global data partnerships will build on the UK's 42 existing adequacy arrangements, and that first priorities for striking new partnerships consist of the US, Australia, the Republic of Korea, Singapore, the Dubai International Financial Centre, and Colombia, while future partnerships with India, Brazil, Kenya, and Indonesia are also being prioritised.
The IDT Guidance
According to the IDT Guidance, and in line with Sections 17A, 74A, 17B(12) and 74B of the Data Protection Act 2018, as part of the test for adequacy the Secretary of State will take into consideration, among other things:
- the rule of law, respect for human rights and fundamental freedoms;
- the existence and effective functioning of an independent regulator; and
- relevant international commitments.
The procedure will consist of four phases of work for UK adequacy:
- Recommendation; and
In addition, the Guidance details alternative transfer mechanisms which can be used to provide appropriate safeguards for international transfers of personal data to third countries under the UK GDPR. Including Standard and customer data protection clauses, Binding Corporate Rules, codes of conduct, and certification schemes.
You can read the press release here, the UK Adequacy Manual Template here, the Manual Guidance here, the UK data partnership map here, the Guidance here, and the call for experts to join the International Data Transfers Expert Council here.