International data transfers outside the UK: a new era
In June last year, the European Commission published updated EU Standard Contractual Clauses under the EU General Data Protection Regulation (“EU GDPR”), however, as they do not apply in the UK as it left the EU, we have eagerly awaited the ICO’s introduction of new contractual safeguards under the UK GDPR (the EU GDPR as incorporated into the law of the UK).
The ICO released a statement on 31 January 2022 in response to the DCMS’s laying of The IDTA, Addendum and transitional provisions before Parliament on 28 January 2022. Provided there are no objections from Parliament, these new transfer mechanisms will come into force on 21 March.
Although expected, following the ICO’s consultation on the IDTA in August last year (read our blog the ICO’s consultation on the IDTA), this is still a significant milestone as the standard contractual clauses adopted under the previous Data Protection Directive 95/46 have been in place since 2001, 2004 and 2010 (the “SCCs”).
International data transfers continue to be a complex area for organisations to navigate, particularly in light of Schrems ll. The ICO highlighted in its statement that the IDTA and Addendum aim to ensure high standards are applied to personal data that is transferred to countries not benefiting from UK adequacy regulations. The UK adequacy regulations set out in law that a third country’s legal framework has been assessed and deemed as providing ‘adequate’ protection for individuals’ rights and freedoms for their personal data.
There will be a transitional period where businesses can continue to rely on the SCCs when entering into new agreements until 21 September 2022, after which, if a restricted transfer continues, any relevant agreements including the SCCs will need to be updated to incorporate these new transfer mechanisms.
A transfer risk assessment must be conducted prior to any restricted transfer when an organisation is entering into a contract on the basis of the IDTA or Addendum. This is to ensure the protections guaranteed under the IDTA or Addendum, are sufficient to achieve their aim of adequately safeguarding personal data that is subject to a restricted transfer.
Need help?
As a specialist data protection consultancy, Evalian is well-placed to assist you with navigating the law governing your international transfers. If you would like an informal conversation on how we can assist, please get in touch. We can steer you in the right direction or if you need help, we can assist at every level to ensure that you are covered.
