Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

UK: ICO launches public consultation on draft IDTA, TRA tool, and international transfer guidance

The Information Commissioner's Office ('ICO') launched, on 11 August 2021, a public consultation on its proposals and plans for, among other things, a draft international data transfer agreement ('IDTA'), transfer risk assessments ('TRA'), and guidance for international data transfers. In particular, the ICO outlined that the IDTA is a contract that organisations can use when transferring data to countries not covered by adequacy decisions and that it will replace the current Standard Contractual Clauses ('SCCs') to take into account the binding judgment of the Court of Justice of the European Union in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18), which requires organisations to carry out further diligence when making a transfer of personal data outside of the UK to countries without adequacy, among other things. 

Consultation paper

The consultation paper is split into three sections with various proposals and options pertaining to proposals and plans for updates to guidance on international transfers, TRAs, and the IDTA. 

Section 1 of the paper contains proposals and options for the ICO to update its guidance on international transfers, notably in the interpretation of the extraterritorial effects of Article 3 of the UK GDPR, and the interpretation of Chapter V of the UK GDPR. Section 2 of the paper requests comments regarding TRAs, specifically the TRA tool. Section 3 of the paper provides proposals and options pertaining to ICO model IDTAs, which consider providing a new set of standard data protection clauses, the adoption of model data transfer agreements issued in other jurisdictions, and disapplying the use of the SCCs issued by the European Commission under the Data Protection Directive 95/46/EC when the ICO issues an IDTA.

Initially, the paper notes that the ICO is planning the following in 2021:

  • to update its guidance on Chapter V UK GDPR and restricted transfers;
  • to provide guidance on how to conduct an international transfers risk assessment; and
  • to issue an ICO IDTA, the ICO version of SCCs under the UK GDPR.

Draft IDTA

The draft IDTA, one of the appropriate safeguards under the UK GDPR, includes guidance on how to complete the IDTA, a template for the same, frequently asked questions, and guidance templates. 

Moreover, the IDTA contains, among other things:

  • tables to set out specific information about the exporter, importer, and the restricted transfer;
  • the option to exclude extra protection clauses;
  • the option to include commercial clauses agreed by the exporter and importer, provided that these do not contradict the IDTA; and
  • a set of mandatory clauses which must always be included.

However, the IDTA notes that organisations must also complete a TRA to ensure that the IDTA works as intended in the country where the receiver of the personal data is located.

Draft international TRA tool

According to the draft international TRA tool, it can be utilised as a method to conduct a TRA, and is designed to assist organisations when making routine restricted transfers rather than more complex or high risk transfers which require a more detailed risk assessments. Specifically, the tool lays out the following three steps on how to carry out the TRA in a structured manner, which are accompanied by guidance and decision trees:

  1. Assessing the transfer;
  2. Is the IDTA likely to be enforceable in the destination country?; and
  3. Is there appropriate protection for the data from third-party access?

Comments may be submitted until 5pm on 7 October 2021 by emailing a completed consultation paper to [email protected]

You can read the press release here, the consultation page here, the draft IDTA here, the draft international TRA and tool here, the draft UK addendum to the EU SCCs here, and the consultation paper here.