UK Government sets out its approach to UK data adequacy decisions
23 Mar 2021 01:58 PM
As the UK looks to secure adequacy arrangements with new partners around the world, the Department for Digital, Media, Culture and Sport (DCMS) and the Information Commissioner’s Office (ICO) have published a Memorandum of Understanding on the role that they both hold in the UK’s new adequacy process.
As the UK awaits the final decision from Brussels on its data adequacy decision – enabling the continued free flow of personal data between the European Economic Area and the UK – the UK government is already making its own preparations to strike new adequacy arrangements with other countries around the globe.
The Memorandum of Understanding, which was signed between the Secretary of State for the Department for Digital, Culture, Media and Sport and the Information Commissioner and published on 19 March, provides details on the UK’s approach to new adequacy arrangements.
The objectives of the Memorandum of Understanding (MoU) include setting out how DCMS and the ICO will share expertise and maintain a working-level of cooperation and consultation and the respective roles and responsibilities of DCMS and the ICO in the context of future decision-making by the Secretary of State in relation to UK Adequacy Regulations.
This transparency is welcome and something techUK has called for.
The MoU outlines the UK Adequacy Assessment Work, which will unfold in four broad phases:
- Gatekeeping – the decision as to whether to commence an assessment in respect of the specific country, territory, business sector or competent international organisation.
- Assessment – collecting and analysing information relating to the level of data protection within the specific country, territory, sector or international organisation.
- Recommendation – DCMS UK Adequacy Assessment team making a recommendation to the Secretary of State who will then decide whether to make a finding of adequacy and make UK Adequacy Regulations in respect of another country, territory, sector or international organisation being assessed.
- Procedural – formalising the relevant UK Adequacy Regulations, laying these in Parliament, and any subsequent publication of the ICO’s opinion.
Despite a close working-level engagement between DCMS and the ICO throughout all the four stages of this process, the UK Government will undertake UK Adequacy Assessment Work and the DCMS Secretary of State alone retains the decision-making power as to the adequacy of another country. The Secretary of State will consult the ICO before making UK Adequacy Regulations and will take into account, but is not bound by, the ICO’s views.
This Memorandum of Understanding will be reviewed between 1 July 2021 and 31 December 2021 and annually thereafter, unless a review is mutually agreed to be required sooner.
Complimenting this development is Minister for Media and Data, Rt. Hon John Whittingdale OBE MP’s blog published by Privacy Laws & Business where he confirms the UK’s intention to expand the list of adequate destinations “in line with the UK’s commitment to high standards of data protection” and remove unnecessary barriers to transfers of data to the UK, from international partners beyond the EU.
The Minister also stated that the UK government will be developing a toolkit based around the data rights and approaches in UK law, which will be focused on removing the unnecessary bureaucracy in the system and on getting the right outcomes for data protection.
techUK has recently published a discussion paper on the future of data governance which provides an number of suggestions to create a success international transfers regime for the UK and we look forward to working with DCMS ahead of the release of the National Data Strategy.