Two new ways to transfer data from the UK: The IDTA and Addendum
Subject to Parliamentary approval, starting 21 March 2022, businesses can transfer personal data from the UK to third countries by executing new transfer agreements. (Under UK regulations, “third countries” are countries or territories outside the UK.)
The first transfer agreement is the UK Information Commissioner’s Office’s (ICO’s) new international data transfer agreement, or IDTA. This option will primarily be used in cases where a UK organisation has no presence in the EU and wishes to transfer personal data to third countries only from the UK.
The IDTA broadly resembles the EU’s standard contractual clauses, or SCCs. As with SCCs, the IDTA is comprised of contractual clauses that have been pre-approved, in the IDTA’s case to allow data transfers from the UK to third countries by ensuring that appropriate safeguards are in place.
There are however differences between SCCs and the IDTA. The IDTA is a single checklist-type document, whereas SCCs are separate documents based on the nature of the role of the parties involved (for example, controller to controller, controller to processor, etc.). In addition, and perhaps more significantly, the IDTA can cover transfers to organisations located in third countries, even if the data importer is directly subject to Article 3(2) of the UK GDPR. SCCs do not cover this type of transfer.
The second agreement for transferring personal data from the UK to third countries is the ICO’s International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Addendum). The Addendum will likely be more commonly used than the IDTA for transfers of personal data outside the UK when an organisation has one or more EU entities within its structure (in addition to its UK entity or entities) that are also transferring personal data to third countries outside the EEA.
UK contracts under old SCCs and a grace period
The ICO has confirmed that any contracts under the old, pre-GDPR EU SCCs that are entered into on or before 21 September 2022 will continue to be compliant until 21 March 2024. Such contracts will remain valid as long as the data processing operations remain unchanged and the old SCCs ensure that data transfers are subject to appropriate safeguards (in line with the requirements of the Schrems II decision).
During this grace period, corporations will not need to abandon contract negotiations under the old SCCs. Instead, they will need to complete such contracts on or before 21 September 2022. This benefit, however, only applies to personal data transfers solely from the UK to third countries; this is because transfers from the EU should no longer be done under the old SCCs. For example, if a US-based corporation is transferring personal data from both the UK and the EU, then the corporation should execute the new EU SCCs and Addendum.
UK entities that have existing contracts under the old SCCs will need to remember to switch to an IDTA or the Addendum starting 21 March 2024.
The grace period that allows continued compliance with the UK GDPR is a welcome announcement for organisations with a UK presence. Moreover, the UK authorities’ decision to closely align the new rules with the EU’s approach to international data transfers will help those organisations stem the rising costs of data protection compliance, since they will have related controls already in place. These cost advantages could help the UK remain a competitive target destination for multinational organisations looking to expand into European markets.
That said, it remains to be seen how EU authorities will receive the UK’s IDTA. The UK is of course no longer subject to EU law (apart from what it has chosen to retain), but it continues to rely on the EU’s adequacy decision, which is temporary and subject to revocation by the EU. A challenge by the European Data Protection Board or EU Commission to the IDTA’s effectiveness may lead EU authorities to question the validity of the adequacy decision. Indeed, the EU’s 2021 adequacy decision for the UK warns that the EU Commission will “closely monitor the situation.”
John Tay, Associate, Solicitor, Vistra Corporate Law, contributed to this article.
How can we help?
The contents of this article are intended for informational purposes only. The article should not be relied on as legal or other professional advice. Neither Vistra Group Holding S.A. nor any of its group companies, subsidiaries or affiliates accept responsibility for any loss occasioned by actions taken or refrained from as a result of reading or otherwise consuming this article. For details, read our Legal and Regulatory notice at: http://www.vistra.com/notices . Copyright © 2023 by Vistra Group Holdings SA. All Rights Reserved.
Domiciling funds in Luxembourg for EU market access: What fund managers should know
30 Nov 2023
Luxembourg has long been a prominent player in the alternative investment market and is the top domiciliation choice in Europe and one of the most popular globally. The country is poised to become…
The basics of customs duties for multinational organisations
22 Nov 2023
Vistra appoints Frank Roden as Country Managing Director, Vistra Luxembourg
21 Nov 2023
Transitioning from equity to credit in private markets
16 Nov 2023
The benefits of outsourcing fund administration
08 Nov 2023
How to prepare for the EU’s BEFIT initiative
01 Nov 2023