Keypoint: The UK/EU Brexit agreement provides for the continuation of UK/EU cross-border data transfers for the next four to six months, allowing the European Commission more time to consider issuing an adequacy decision.

On December 24, 2020, the United Kingdom and the European Union announced a number of agreements concerning the United Kingdom’s exit from the European Union (Brexit).

As part of the Trade and Cooperation Agreement (Agreement), the sides reached an interim provision for the transmission of personal data to the United Kingdom. Specifically, the parties agreed that for “the duration of the specified period, transmission of personal data from the Union to the United Kingdom shall not be considered [a] transfer to a third country under Union law,” provided that the United Kingdom does not modify its existing data protection law and does not exercise certain provisions provided for in that law without EU agreement.

The Agreement defines “specified period” as beginning on the date the Agreement enters into force and ending (1) the date that the European Commission issues an adequacy decision or (2) four months after the beginning date, which period can be extended by two additional months unless one of the parties objects.

The relevant provisions begin on the bottom of page 406 of the Agreement.

Ultimately, the Agreement avoids (at least for four to six months) a scenario in which the United Kingdom leaves the EU without an adequacy decision thereby triggering the need for the use of appropriate safeguards or derogations for UK/EU data transfers.

The Brexit agreements still need to be ratified by the United Kingdom’s Parliament and the Council of the EU.

[View source.]