The U.K. government has officially confirmed that it will extend a transatlantic data transfer deal between the European Union and the U.S., creating the “U.K.-U.S. data bridge.” This move follows an agreement reached in June between the U.K. and the U.S. to facilitate digital commerce by allowing the exportation of U.K. citizens’ data to the U.S. The extension ensures that the data is protected according to the U.K.’s data protection regime, known as the U.K. GDPR. Adequacy regulations have been laid in Parliament and will come into effect on October 12, allowing U.K. businesses to securely transfer personal data to certified U.S. organizations.
Key Takeaway
The U.K. government has confirmed the extension of a transatlantic data transfer deal, creating the “U.K.-U.S. data bridge.” This agreement will enable U.K. businesses to safely transfer personal data to certified organizations in the U.S., ensuring the protection of individuals’ data.
U.K. Extension to the EU-US Data Privacy Framework
The U.K. government has determined that the U.K. extension to the EU-US Data Privacy Framework maintains high standards of privacy for U.K. personal data. This decision is supported by the U.S. Attorney General, who designated the U.K. as a “qualifying state” under Executive Order 14086 on September 18. This designation grants U.K. individuals access to a redress mechanism in the event of unlawful access to their personal data by U.S. authorities for national security purposes.
The U.K.-U.S. data bridge allows certified U.S. companies under the EU framework to receive U.K. personal data. While this decision is seen as a rational move to address Brexit’s impact on data transfer, concerns arise regarding the longevity of the arrangement. The EU’s Data Privacy Framework is facing legal challenges and has been struck down twice by the EU court of justice. If the framework collapses, the viability of the U.K.’s extension will be questionable. However, as the U.K. no longer falls under the jurisdiction of the EU court, it is possible that the U.K.’s extension will survive. Additionally, the U.K. government’s move to weaken domestic privacy standards further complicates the situation.
It is worth noting that the U.K. has previously signed data sharing deals post-Brexit, including an adequacy decision with South Korea in July 2022. The U.K. continues to navigate data protection reforms following its departure from the European Union.
