On 11 August 2021, the Information Commissioner’s Office (“ICO”) published a consultation regarding its draft guidance for international transfers of personal data (“Guidance”), as well as associated data transfer tools which serve to replace Standard Contractual Clauses (“SCC”).
The ICO’s post-Brexit data protection actions include these new documents, which are subject to consultation:
- Proposals aimed at addressing international transfers of personal data outside of the U.K.
- An international transfer risk assessment guidance proposal (the “Risk Assessment Guidance”)
- The international data transfer agreement (“ITDA”)
- Draft U.K. Addendum to the EU Commission standard contractual clauses
The ICO’s proposals and draft tools indicate the regulator is attracted to taking advantage of its ability to impose its own regulations post-Brexit. With the aim of aiding organisations navigate international data transfers subject to the UK GDPR regulations, the consultation provides an indication as to how data protection regulations are likely to be applied in the UK. Notably, with regards to countries that have not been granted adequacy status under the UK GDPR, the transfer risk assessment (“TRA”) provides an approved format for executing the required risk assessments regarding the international transfer of personal data.
The consultation addresses considerations which allow the ICO to review areas of the UK GDPR they consider require clarification in relation to the IDTA. The ICO’s document equally clarifies the UK’s position in relation to the European Commission’s new SCCs, published in June. Further information regarding the European Commission’s new SCCs can be found here.
The ICO has published a thorough post-Brexit consultation which addresses international transfers of personal data out of the UK and aims to interlink EU and global data protection and privacy laws and practice. It will be interesting to analyse and explore the responses the ICO receives with regards to their consultation as well as how the ICO will apply these new regulations.
The ICO consultation can be found here.
Please contact Jose Saras if you have any questions on post-Brexit international transfers of personal data.
The material contained in this article is only for general review of the topics covered and does not constitute any legal advice. No legal or business decision should be based on its content.