As indicated in the official announcement, effective January 1, 2021. The free flow of data between the European Economic Area (27 EU member states plus Iceland, Liechtenstein and Norway) and the United Kingdom will be maintained. Until July 1, 2021. This is provided by the so-called traffic clause in the final provisions Trade and Cooperation Agreements between the European Union and the European Atomic Energy Community on the one hand and the United Kingdom of Great Britain and Northern Ireland on the other, which will govern the future relationship between the European Union and the United Kingdom.
The Personal Data Protection Office clarifies that in accordance with Art. FINPROV 10A of the Agreement, which sets out the transitional provisions for the transfer of personal data to the United Kingdom, These transfers will not temporarily be considered transfers of data to a third country. Thus, entrepreneurs or public entities will not be required to meet the additional requirements set out in Chapter 5 of the GDPR. This also applies to the additional requirements for international data transfers set out in Chapter 3A of the Law of September 16, 2011. On the exchange of information with law enforcement authorities of EU Member States, third countries, EU agencies and international organizations, implementing Chapter V of the Directive ( European Union) 2016/680 in the Polish legal system.
Transition period – how long?
The transition period will end on July 1, 2021 at the latest, that is, six months after January 1, 2021. The agreement provides for a period of four months, but it will be automatically extended for another two months, unless one of the parties to the agreement objects to it. The transition period may also end earlier, When the European Commission under art. 36 sec. 3 of Directive (EU) 2016/680 and pursuant to art. 45 seconds. 3 General Data Protection Regulation Will issue executive decisions regarding an appropriate level of data protection With regard to the United Kingdom, stated the press release.
Reporting data after the end of the transition period
As confirmed by the Personal Data Protection Office, the European Commission in the announcement relating to the adoption of a adequacy resolution for the United Kingdom It announced its readiness to quickly initiate formal action in this regard. Before making such decisions will be required An assessment of British personal data protection law and the practice of its application in light of the jurisprudence of the Court of Justice of the European Union. Submission of data on the basis of a decision of the European Commission will be possible without the need to meet additional conditions. However, if the European Commission does not issue an adequate decision within that period, the transfer of data to the UK after the end of the transition period will primarily require the application of the safeguards provided for in Art. 46 GDPR (eg Standard Contractual Clauses or Binding Company Rules).
Free Data Flow – Terms
According to the content of the communication, the free flow of data during the transition period will be conditional on the UK remaining in effect on December 31, 2020. Provisions on the protection of personal data based on EU law, i.e. the General Data Protection Regulation (EU) Directive 2016/680. The UK will not be able to exercise its jurisdiction over international data transfers during the transition period.
Information Commissioner’s role
What UODO pays attention to is the fact that as of January 1, 2021. The Comprehensive Cooperation Mechanism (OSS) for cross-border data processing will not apply to the UK, and therefore the Information Ombudsman (ICO) will not participate in it.
Agreement – Implementation Process
Negotiations on the agreement ended on December 24, just before the end of the current transitional period. On December 29, the Council of the European Union decided to sign the agreement and its provisional application. The agreement was formally signed by both parties on December 30. Its entry into force will depend on the fulfillment of further procedural requirements, including the approval of the European Parliament, which may be granted in early 2021. That is why it is planned The provisional application of the agreement from January 1, 2021, which, however, may not last longer than February 28, 2021. – explains UODO.
As announced in the announcement, the Personal Data Protection Office will monitor the progress of the work in progress and update the information provided, if necessary.
Current information is published by the European Commission on the website: https://ec.europa.eu/info/european-union-and-united-kingdom-forging-new-partnership/future-partnership/draft-eu-uk-trade-and-cooperation-agreement_en
Information on the decision taken by the Council of the European Union:
https://www.consilium.europa.eu/en/press/press-releases/2020/12/29/eu-uk-trade-and-cooperation-agreement-council-adopts-decision-on-the-signing/
A statement by the European Data Protection Council, published before the conclusion of the negotiations: https://uodo.gov.pl/pl/138/1793
Entrepreneur status
From January 1, 2021. The General Data Protection Regulation (GDPR) will apply directly to these entrepreneurs – refers to the Personal Data Protection Office. The GDPR also applies to the processing of data relating to persons residing in the European Union by a controller or processor who does not have organizational units in the European Union, if such activities are related to:
- provide goods or services to such persons who are in the European Union, whether or not they are required to pay; or
- Monitor their behavior insofar as this behavior occurs in the European Union.
Such entrepreneurs must designate their representative in writing in the European Union in the Member State where their personal data is processed in connection with the offering of goods or services or whose behavior is monitored – as described in the communication.
Entrepreneurs do not have to appoint their representative if their processing is incidental, does not involve – on a large scale – the processing of special categories of personal data, or the processing of personal data relating to criminal convictions and prohibited acts, which is also unlikely because of its nature, context, scope and objectives , they run the risk of violating the rights or freedoms of natural persons.
Personal data protection office press release
