ICO consults on new agreement for data transfers outside the UK

Kathryn Wynn of Pinsent Masons, the law firm behind Out-Law, said the option to adopt the UK addendum would be attractive to global businesses that have already been engaged in updating data transfer agreements to reflect the revised EU SCCs.

The draft UK addendum has been published by the Information Commissioner’s Office (ICO) alongside a new draft international data transfer agreement (IDTA). The draft IDTA is in effect the UK equivalent of the EU SCCs. It has been designed to govern the handling and safeguarding of personal data by those importing personal data from the UK while giving exporters confidence that the data transfer arrangements are in line with the UK General Data Protection Regulation.

Wynn said: “The draft IDTA is very user-friendly, with the form-filling format and plain English language making it much more accessible to all businesses and not just those with in-house data protection expertise – certainly more so than the EU SCCs, which are much more dense and framed in tighter legal terms.”

“However, my view is that multinational businesses are likely to favour implementing the EU SCCs and bolting on the UK addendum to those data transfer agreements as a means of achieving compliance with the UK GDPR, rather than adopting the IDTA as their baseline for meeting the requirements of data protection law elsewhere in the world, including in the EU, around data transfers,” she said.

The ICO said that it considers its addendum “provides appropriate safeguards for the purposes of transfers of personal data to a third country or an international organisation in reliance on Articles 46 of the UK GDPR and, with respect to data transfers from controllers to processors and/or processors to processors”.

Both the draft IDTA and draft UK addendum to the EU SCCs are open to consultation. Stakeholders have until Thursday 7 October to share their feedback.

The European Commission was motivated to update the EU SCCs, and the UK ICO develop a distinct IDTA for the transfer of personal data outside of the UK, following a ruling of the Court of Justice of the EU (CJEU) in 2020 in which the court identified shortcomings with the existing EU SCCs that the European Commission previously developed. That ‘Schrems II’ ruling has also spurred the European Data Protection Board (EDPB) to publish finalised recommendations on measures that supplement transfer tools to help businesses comply with the EU GDPR when transferring personal data to ‘third’ countries.

The ICO has proposed to “disapply” the existing EU SCCs once the new IDTA is in force. The ICO is consulting on the transition periods that should apply in this context but has initially proposed that all new data transfer agreements reflect the new IDTA within three months of the IDTA taking effect and for all existing data transfer agreements to be updated within 21 months of that date too. It plans to lay the finalised IDTA before the UK parliament where it would be subject to a negative procedure, meaning the statutory instrument would take effect 40 days after it was laid unless objections were raised by parliamentarians within that period.

Steve Wood, ICO executive director of regulatory strategy, said: “The modern world involves increasing flows of personal data about citizens to deliver goods and services. Ensuring data is well-protected when transferred outside of the UK will be vital in maintaining people’s trust in the system. Our new IDTA is developed to ensure such protections are in place.”

“This consultation is important. We know how important it is for transfer tools to work in practice, and the ICO wants to support businesses in this area. The responses we receive will inform our final work and I encourage all organisations that undertake international transfers to engage with the consultation and provide feedback,” he said.