Data Bridge for UK-US data transfers officially confirmed

On 21 September 2023, the UK government announced its decision to approve adequacy with the US by establishing a ‘data bridge’. The regulations are due to come into force on 12 October 2023 and aim to provide a secure and streamlined mechanism for transferring personal dataInformation which relates to an identified or identifiable natural person. between the UK and US. The US Attorney General officially recognised the UK as a ‘qualifying state’ on 18 September, under the provisions of Executive Order 14086. 

This decision comes a little over two months after the European Commission’s adequacy decisionA decision adopted by the European Commission on the basis of Article 45 of the GDPR, which establishes that a third country (i.e. a country not bound by the GDPR) or international organisation ensures an adequate level of protection of personal data. Such a decision takes into account the country's domestic law, its supervisory authorities, and international commitments it has... on 10 July 2023, with the implementation of the EU-US Data Privacy FrameworkThe EU-US Data Privacy Framework (EU-US DPF) is a set of principles and safeguards for transferring personal data from the EU to certified US organisations. The programme took effect on 10 July 2023, replacing the invalidated Privacy Shield, and the EU Commission has since deemed transfers made from the EU to certified US organisations Adequate.  (DPF). 

Michelle Donelan MP, UK Secretary of State for Science, Innovation, and Technology (DSIT) took the decision under Section 17A of the Data Protection Act 2018The Data Protection Act 2018 is a United Kingdom Act of Parliament which updates data protection laws in the UK (and supersedes the Data Protection Act 1998), and implemented the GDPR into UK legislation.. DSIT have published a range of data bridgeAlso referred to as the UK-US data bridge, this is the UK’s extension to the EU-US Data Privacy Framework. It allows UK organisations to transfer personal data to certified US organisations from 12 October 2023, without having to put in place an alternative transfer mechanism.  supporting documents. 

Acting as an extension to the EU-US DPF, the new data bridge will allow UK organisations to transferThe movement of data from one place to another. This could be, for example, from one data controller to another, or from one jurisdiction to another. personal data to certified US organisations from 12 October 2023. The data bridge will bolt onto the EU-US DPF and both US and UK governments have stated this will bring economic opportunities for businesses and facilitate innovation, especially for science and research. 

However, with the recent legal challenges to the EU-US DPF by French MP Phillippe Latcombe, and probable challenges from Austrian lawyer, Max Schrems, the long-term fate of both the EU-US DPF and the new UK data bridge is uncertain. As these challenges unfold, there will likely be new complexities and considerations for businesses and governments. Read about the EU-US DPF Program and the recent challenges in our latest blog. 

Rik Mannix, Data Protection Officer at The DPO Centre has this advice for organisations: 

‘The UK-US data bridge certainly comes as good news to US businesses that maintained their Privacy ShieldUS Certification scheme, now replaced by Data Privacy Framework. standards and certification. From 12 October, the new UK mechanism can be used when exporting data to qualified US companies, certified under the DPF Program. A coincidence, perhaps, that the 12th of October is the same date Christopher Columbus discovered the New World.  

However, it must also be noted that the concerns raised about the EU-US DPF remain and the fate of the new data bridge is inexorably tied to the outcome of the DPF challenges.’ 

For more news and insights about data protection, follow The DPO Centre on LinkedIn