Boardroom Brexit: What the deal means for personal data and digital trade

Personal data

The TCA allows personal data to transfer from the EU-UK, for a period of up to six months from 1 January 2021. This ‘bridging’ period is designed to allow the EU time needed to adopt a formal adequacy decision which will allow the continuing flow of personal data to the UK. The EU-UK Joint Declaration, published alongside the TCA, includes a commitment from the EU to secure that decision. During this bridging period, the UK will benefit from a free flow of data from the EU, but is restricted from adopting its’ own adequacy decisions, or approving any new standard contractual clauses (SCCs), that go beyond those already approved by the EU.

This interim arrangement will be welcome, as there were major concerns that a no-deal scenario would prevent organisations from transferring data into the UK without the burden of adopting SCCs and conducting transfer impact assessments for every data transfer. The hope now is that the EU will expedite a UK adequacy decision within a few months and provide long term certainty for the future flow of data.

The TCA doesn’t address the wider implications of Brexit on data protection. For example, TCA includes no specific commitments to support regulatory co-operation, or joint enforcement between supervisory authorities. Nor are there any changes to the requirements to appoint local data protection officers and representatives under each regime. From 1 January, the harmonized approach we have become used to under the GDPR will cease. Organisations operating in both trading areas will need to be ready to manage privacy compliance under what will become two separate (albeit largely parallel) legal and regulatory enforcement regimes and structure their privacy office and compliance structures accordingly.

Read more on the data protection implications of the deal >>

Digital trade

The TCA contains a chapter on digital trade, which is an often overlooked area when negotiating free trade agreements. As such, this is good news for businesses in the digital and technology sectors as this chapter details more specifically with how goods and services can be traded via digital channels and aims to promote the digital trade. The UK and EU have also provided an overall commitment to cooperate on digital trade issues in the future, particularly in relation to consumer protection and emerging technologies, such as artificial intelligence and blockchain; and to avoid restrictive practices such as data localisation rules. 

The TCA states that electronic transmissions shall be considered as the supply of a service, and neither the UK nor EU will impose customs duties on such electronic transmissions. Moreover, there are provisions in the TCA which mean services can be provided digitally by default without requiring prior authorisation; and also a guarantee against the forced transfer of source code, thereby protecting valuable business intellectual property. These aspects of the TCA are all good news for businesses, particularly for the further facilitation of digital trade. 

There are also provisions which guarantee that neither the UK or EU will discriminate against electronic signatures or electronic documents on the basis they are in digital form (i.e. not paper-based), and the TCA ensures that contracts can be completed digitally, albeit with a small number of exceptions including but not limited to legal services, gambling services and broadcasting services. 

The digital trade chapter also contains clauses in relation to consumer protection. These place obligations on digital traders to ensure consumers buying goods and services digitally are protected, provided with clear and thorough information in respect of the digital transaction; and protected from unsolicited direct marketing communications (i.e. spam). Both parties also recognise the importance of consumer protection agencies and have agreed to allow UK and EU bodies to cooperate and enforce breaches of UK and EU consumer rights. These are important provisions to protect consumers when buying from UK and EU digital businesses, but business undertaking such digital trade should ensure they understand these new obligations and comply with them appropriately.  

Lastly, the TCA also addresses the important role that government data can play in economic, social and digital development. As such, the parties have agreed that when the UK or EU make non-personal or anonymised public sector data available, this provision will encourage them to make that data more easily accessible and in machine-readable formats in order to be utilised more effectively.