Privacy & Information Security Law Blog

On August 26, 2021, the UK Department of Culture, Media and Sport (“DCMS”) made news by publishing a document indicating its intent to begin making adequacy decisions for UK data transfers to foreign jurisdictions and by announcing its preferred candidate for the position of new UK Information Commissioner.

UK Adequacy Recognition

The DCMS published a Mission Statement with respect to international data transfers, International data transfers: building trust, delivering growth and firing up innovation (the “Statement”). The Statement sets forth a list of priority jurisdictions for UK adequacy determinations, notably including the U.S. Now that the UK has left the EU, it has the power (under Chapter V of the UK General Data Protection Regulation (“UK GDPR”)) to independently assess the standard of data protection in other jurisdictions, and recognize certain jurisdictions as adequate for the purpose of foreign UK data transfers. Once a jurisdiction is deemed adequate, UK personal data will be able to be transferred to the jurisdiction without the implementation of additional safeguards.

The Statement highlights the importance of international data transfers in driving commerce, trade and development, noting that in 2019, investments in the UK tech sector reached £10.1bn – the highest level in UK history. The Statement also highlights the role of data transfers in underpinning innovation, research and development, supporting international cooperation (including with respect to law enforcement, fraud prevention and national security) and enabling individuals to stay emotionally and socially connected to one another.

The jurisdictions listed as high priority for UK adequacy decisions are: Australia; Brazil; Colombia; the Dubai International Financial Centre; India; Indonesia; Kenya; the Republic of Korea; Singapore; and the U.S. (EU and EEA Member States are already recognized as adequate by the UK, in addition to jurisdictions such as Argentina, Japan, Switzerland, New Zealand and Israel).

The adequacy of a jurisdiction will be determined on the basis of whether the level of protection under the UK GDPR is undermined when UK data is transferred to the jurisdiction, which requires an assessment of the importing jurisdiction’s data protection laws, and their implementation, enforcement and supervision. In particular, the UK will take into consideration the jurisdiction’s respect for the rule of law and human rights and fundamental freedoms, whether there is an effective and independent regulator in the recipient jurisdiction, and any relevant international commitments to data protection (such as legally binding conventions or its participation in multilateral or regional systems). The Statement notes, however, that the UK Government understands that governments have to keep their citizens safe and, in doing so, necessary and proportionate interference with the right to privacy can be justified in order to protect the public and such interference is compatible with high standards of privacy.

The Statement specifies four phases in assessing the adequacy of a jurisdiction, which were previously included in the Memorandum of Understanding between the DCMS and the UK Information Commissioner’s Office (“ICO”). In the first “gatekeeping” phase the UK Adequacy Assessment team (which consists of specific teams within DCMS, with the support of the ICO) will evaluate whether to commence an adequacy assessment with respect to a particular jurisdiction, taking into account a number of policy factors, including the jurisdiction’s trade and diplomatic relationship with the UK. The second “assessment” phase involves an analysis of  the jurisdiction’s level of data protection, which will be evaluated by the UK Adequacy Assessment team using a template set of questions.

Following this assessment, in the third phase, the UK Adequacy Assessment team will make a recommendation to the UK Secretary of State, who will consult with the ICO and other stakeholders and decide whether to make a determination of adequacy. In the fourth and last phase, the relevant regulations will be presented to Parliament to give legal effect to the Secretary of State’s determination.

Adequacy decisions will be reviewed at least once every four years, and the Secretary of State will have the power to amend or revoke any UK adequacy decision. In addition, adequacy decisions may be challenged via application for judicial review, and will be annulled if such a review is successful.

New UK Information Commissioner Proposed

On August 26, 2021, the DCMS also announced that John Edwards was its preferred candidate to succeed Elizabeth Denham as UK Information Commissioner when she steps down from the post in October 2021. Edwards will appear before the DCMS Select Committee for pre-appointment scrutiny on September 9, 2021.

John Edwards, who is currently serving out his second five-year term as New Zealand’s Privacy Commissioner, was appointed to his current post in 2014, and was responsible for the recent implementation of New Zealand’s Privacy Act 2020. He was also Chairman of the Global Privacy Assembly (then known as the International Conference of Data Protection and Privacy Commissioners) from 2014 to 2017.