1. Rules on international data transfers for the specified period in the EU-UK trade and cooperation agreement

The Trade and cooperation agreement between the EU and the UK allows personal data to flow freely from the EU (including from Luxembourg) to the UK, until an adequacy decision have been adopted, for no more than six months.

The EU data protection rules continue to apply in and to the United Kingdom for a specified period as from 1 January 2021, pursuant to article FINPROV.10A of the interim provisions of the EU-UK agreement.

This article FINPROV.10A provides that the specified period shall begin upon entry into force of the agreement and shall end:

  • if the UK is found to offer an adequate level of protection in the meantime (by way of an adequacy decision adopted by the European Commission);
  • on the date four months after the specified period begins, which period shall be extended by two further months, unless one of the parties objects.

This means that companies, public bodies and Luxembourg associations that intend to continue to transfer personal data to the United Kingdom, will not need to take additional steps for the designated period1, which means at the latest until 1st July 2021.

However, they must continue to comply with the general principles of the General Data Protection Regulation and shall apply them when transferring personal data to the United Kingdom (e.g. the principle of lawfulness, the compatibility of the communication with the initial processing activity, information to the data subjects).

---------------------------------------------------------------------------------------------------------------------

1 Unless the UK proceeds with one of the specified acts without the agreement of the EU (such as: approve new legislation, approve UK BCRs, issue new standard contractual clauses, authorise administrative arrangements or codes of conduct)

Dernière mise à jour