The Parties reached and agreement on the terms and conditions of the Trade and Cooperation Agreement (TCA) between the EU and the UK almost at the last minutes before the post-Brexit transition period ends on 31 December 2020. (The TCA is still subject to final approval.)

The text of the draft agreement, which is more than 1,200 pages long, became available on 26 December. (The UK government has previously published a summary highlighting key points from the TCA.) From a data protection point of view, one of the most awaited part of the agreement is the one related to data transfers from the EU to the UK since it has immediate effect on the data flows between the EU and the UK after the expity of the transition period.

What will happen on January 1, 2021?

With the exit from the EU, the United Kingdom has become a third country from a data protection point of view. After the Brexit (i.e. as of 1 February 2020), there has been no substantive change regarding data transfers in the transitional period compared to the previous ones, i.e. data could be transferred to the UK in the same way as before. However, this transition period ends on December 31, 2020.

How does the TCA affect the above?

The final provisions of the TCA (Article FINPROV.10A, see from page 406) include further transitional provisions for data transfers between the EU and the United Kingdom. According to such provisions:

For the duration of the specified period, transmission of personal data from the Union to the United Kingdom shall not be considered as transfer to a third country under Union law, provided that the data protection legislation of the United Kingdom on 31 December 2020, applies and provided that the United Kingdom does not exercise the designated powers without the agreement of the Union within the Partnership Council.

The specified period  begins on the date of entry into force of the TCA and ends:

• on the date on which adequacy decisions in relation to the UK are adopted by the European Commission, or
• on the date 4 months after the specified period begins, which period shall be extended by 2 further months unless one of the Parties objects;

whichever is earlier.

If the UK changes its applicable data protection regime or exercises the designated powers (see the list of such powers in Article FINPROV.10A, Point 3) within the specified period (4 + 2 months or until the adoption of the adequacy decision) without the agreement of the EU within the Partnership Council, the specified period shall end on the date on which the powers are exercised or the amendment comes into force. 

(The above transfer rule also applies to transfers from Iceland, Lichtenstein or Norway to the United Kingdom.)