New guidance on UK approach to international data transfers & new Information Commissioner

The Department for Digital, Culture, Media and Sport (DCMS) released new guidance last week on how the UK is going to approach international data transfers and, more specifically, Adequacy decisions in the future.

On the 26th of August, the Department for Digital, Culture, Media & Sport set out new procedures for making Adequacy decisions, which aim to “deliver innovative alternative mechanisms and remove unjustified barriers to international data transfers.” The UK’s new Adequacy decisionA decision adopted by the European Commission on the basis of Article 45 of the GDPR, which establishes that a third country (i.e. a country not bound by the GDPR) or international organisation ensures an adequate level of protection of personal data. Such a decision takes into account the country's domestic law, its supervisory authorities, and international commitments it has... processA series of actions or steps taken in order to achieve a particular end. appears to be less rigorous than its EU counterpart, taking a “flexible approach to adequacy”. In addition to this new decision process, it is believed that the UK will also be scrapping some EU GDPRRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data (General Data Protection Regulation). restrictions that are seen as “pointless bureaucracy”, including the requirement for websites to include a cookie banner asking for consentAn unambiguous, informed and freely given indication by an individual agreeing to their personal data being processed. to use non-essential cookiesCookies created by third parties and dropped on website users, for the purposes of analytics or advertisement tracking..

The proposals are significant because they show clear intention to diverge from the EU. It remains to be seen what impact these developments will have on the UK’s own Adequate status, however, an EU Commission spokesperson has warned that any “problematic developments that negatively affect the level of [personal data] protection” provided by the UK could lead to the Adequacy decision being suspended at any time.

The DCMS also announced their new preferred candidate to take over the role of Information Commissioner from Elizabeth Denham, who will step down in October, is John Edwards, New Zealand’s current Privacy Commissioner.

For more information, read the guidance document here.