UK International Data Transfer Agreement Laid Before Parliament

On 2 February 2022, the Secretary of State laid before UK Parliament the UK’s international data transfer agreement (“IDTA”), the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (“Addendum”) and a document setting out transitional provisions.  The documents can be accessed here.  This most recent step in the UK’s approach to international transfers follows the consultation run by the Information Commissioner’s Office (the data protection regulator in the UK) during 2021.  Provided no objections are raised in respect of the documents, they will come into force on 21 March 2022. 

The IDTA and Addendum are intended to replace the current standard contractual clauses for international transfers used in the UK and take into account the binding judgement of the European Court of Justice, in the case commonly referred to as “Schrems II”.  The ICO noted in a statement that the aim of the IDTA and Addendum is to help organisations “ensure they have the correct protections in place when transferring people’s data outside of the UK” and that applying “high standards of data protection to global data flows is essential in maintaining people’s trust in this eco system”. 

The hope is that the new IDTA and Addendum will work efficiently and effectively alongside the latest standard contractual clauses of the European Commission that were adopted in June 2021.  Since the time of their adoption, international transfers from the UK have been in a state of flux as the new EU standard contractual clauses could not be used to lawfully transfer personal data from the UK to a third country. This has proved particularly difficult for organisations operating in both the EU and the UK that are transferring data sets from the EU and the UK under the same agreement, for example to a service provider engaged to undertake processing services for all EU and UK operations, with such organisations having to incorporate two different sets of standard contractual clauses. 

We are in the process of reviewing the IDTA and the Addendum in detail and will follow up in due course with commentary on the documents, including our views on how effective they will be in ensuring data is adequately protected when transferred to a third country and how efficiently they will work alongside the EU standard contractual clauses.