On the 31st December 2020, the transition period for the United Kingdom’s (UK) withdrawal from the European Union (EU) terminated; meaning that the UK is now deemed to be a third country.

Transfers of personal data to a third country shall only be lawful in case that the conditions laid down in Chapter V of Regulation (EU) 2016/679 (GDPR) are upheld. One of these conditions is that the European Commission has issued an “Adequacy Decision” stipulating that the third country concerned ensures an adequate level of protection. An Adequacy Decision is not yet in place with respect to the UK.

On the 24th December 2020, an EU-UK Trade and Cooperation Agreement was reached. This Agreement, provisionally entered into force on the 1st January 2021, provides that, for a maximum period of six months from its entry into force, all transfers of personal data between stakeholders subject to GDPR and UK entities will not be considered as transfers to a third country subject to the provisions of Chapter V GDPR. This interim measure shall apply insofar as the UK’s current data protection regime remains in force for the entire duration of this six-month provisional period.

In the event that an Adequacy Decision applicable to the UK is not adopted by 30 June 2021, then transfers of personal data between stakeholders subject to GDPR and UK entities will constitute international data transfers subject to the provisions of Chapter V GDPR.

Organisations based in Malta or having designated the IDPC as lead supervisory authority are invited to start taking action to ensure that their cross-border personal data processing operations are not impacted or otherwise prejudiced. In this respect, organisations are encouraged to monitor the development of the situation and to identify the safeguards of Chapter V of Regulation (EU) 2016/679 that may be adopted to keep transferring personal data to the UK at the end of the provisional period indicated above in the event that an Adequacy Decision is not reached.

Specific guidance on this matter can be found on the following hyperlink.

Article by Marco Miozzi, 15th January 2021