TMC incl. data protection

During the transition period the current data protection legislation (in particular, the EU General Data Protection Regulation – GDPR) remained in force.

In particular, until the transition period expired the UK has not been deemed a "third country" so that supplementary conformation/action to ensure an adequate level of data protection has not been required for the transfer of personal data to recipients in the UK.

The following action could be considered:

General confirmation of an adequate level of data protection on the strength of an "adequacy decision" by the EU Commission (currently in place for 12 countries (add. UK, see column on the right) and for certified US recipients under the EU–US Privacy Shield)

Binding Corporate Rules for data transfer within companies, with the approval of the regulatory authorities

Conclusion of agreements with recipients on the basis of EU standard contractual clauses (judicial review likely).

Regarding data protection, the Trade and Cooperation Agreement between the EU and the UK provides another transition period of four months. The duration of this period has been extended by two additional months because none of the parties of the agreement did object. During the course of that period, data transmission to the UK has not been classified as data transfer to a "third country". 

As of 28 June 2021, the EU Commission confirmed the adequate level of data protection on the strength of an "adequacy decision" for the UK based on Art. 45 GDPR. This adequacy decision remains in force until the 27 June 2025. Due to this decision, the UK is not deemed an unsafe "third country" with regard to data transfer.

Further requirements regulating the transfer of personal data to recipients in the EU may arise from UK legislation.