Brexit: Domestic businesses are taking a respite in this regard

At the end of January 2020, the UK withdrew from the European Union, but during the transition period until the end of last year, previous rules in the area of ​​data protection also remained in effect. With the broad outlines of the agreement not yet visible in the middle of last month, the European Data Protection Council issued data transfer guidelines for a non-agreed-upon Brexit.

Then, a trade and cooperation agreement was reached on December 24, which was signed by negotiators on December 30 and ratified by the UK Parliament. Since the European Parliament will not ratify the agreement until later, in early 2021, it will be applied temporarily from January 1.

• The main requirement for data protection in the agreement is that personal data may be transferred from the Federation to the UK without further guarantees for 4 months from the end of the transition period.
• This deadline will be automatically extended by two months unless the European Union or the United Kingdom object.

This is conditional on the UK continuing to enforce the EU Data Protection Regulation (GDPR) rules as it has been moved into national law. This period will end sooner if, in the meantime, the European Commission adopts the UK compliance decision.

For a period not exceeding 6 months after the end of the transition period, personal data may continue to be transferred to the UK without special measures being taken. This means that at present, there is no need for special safeguards, such as applying general terms and conditions for these transfers, said Baker MacKenzie, head of data protection.

“However, the UK’s data protection authority, ICO, has drawn attention to the fact that during these six months, companies must also be prepared, as a reasonable precaution, to develop alternative data transmission mechanisms in the absence of a compliance decision,” Csaba emphasized. .

As an important condition of the agreement, neither party shall allow direct marketing communications to be sent to individuals without their consent. Although companies can use so-called “soft subscription”, that is, they can send a message to their customers about similar products and services for direct business acquisition, if the parties do not object. However, among other things, this method is not permitted in Hungary.

The European Union and the United Kingdom also agreed to cooperate on data protection at the bilateral and multilateral levels through dialogue, exchange of experiences and criminal cooperation. With regard to data translation, the two parties agreed that neither of them would require data (including personal data) to be stored or processed on their territory.

The agreement also stipulates that cooperation between the parties in the field of law enforcement is conditional on providing adequate guarantees in their data protection legislation. Either party may suspend this cooperation in the event of serious and systematic deficiencies in the data protection system of the other party.

In some cases, the agreement does not contain a specific clause, but it is important to note that data transfers from the UK to the European Economic Area may continue without specific guarantees. The United Kingdom already considers all member states of the European Economic Area to have an adequate level of data protection.

In addition, the island country has taken conformity decisions for non-member states of the European Economic Area that the European Commission has already taken a similar decision on, so that personal data can be transferred to these countries without restrictions. However, these are unilateral decisions, meaning they can be revoked, amended or supplemented by the UK at any time.