Today, the UK Department for Science, Innovation and Technology
announced further details on the new transatlantic data flow
mechanism for UK-to-US personal data transfers. In particular, the
UK Secretary of State for Science, Innovation, and Technology today
laid new adequacy regulations before the UK Parliament to give
effect to the proposed arrangement. The deal, announced "in
principle" in June, is a UK extension to the EU-US Data
Privacy Framework ("DPF"), finalised in July. The
extension creates a UK-US data bridge, allowing organisations to
transfer personal data subject to the UK General Data Protection
Regulation ("UK GDPR") to participating US
organisations.
Previously, standard contractual clauses or binding corporate rules
would typically be in place before a UK-based data transfer could
be made across the Atlantic. Those mechanisms can still be used,
but US organisations subject to the jurisdiction of the US Federal
Trade Commission ("FTC") or the US Department of
Transportation ("DOT") will now be able to self-certify
to the UK extension to the DPF and benefit from the new UK-US data
bridge. Organisations that wish to participate in the UK extension
must also participate in the EU-US DPF and comply with its
principles.
The UK government estimates that the country exported £79
billion of data-enabled services to the United States in 2021. It
is hoped that the new data flow agreement will further stimulate
economic growth between the two countries and encourage more
businesses to operate on an international scale. However, US
organisations outside the jurisdiction of either the FTC or
DOT—such as banks and insurance and telecommunications
companies—are currently unable to participate in the DPF
program.
Businesses in the United Kingdom can start to transfer personal
data to certified US organisations on 12 October 2023.
Additional author: Oliver Jones
Visit us at mayerbrown.com
Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the "Mayer Brown Practices"). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC ("PKWN") is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. "Mayer Brown" and the Mayer Brown logo are the trademarks of Mayer Brown.
© Copyright 2023. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.