Payroll professionals, especially global payrolls, rely heavily on the movement of personal and confidential data around the world. The free movement of data is something that has been under the spotlight since the United Kingdom left the European Union (EU).
No such free movement agreement could be reached during 2020, however, a temporary UK-EU Trade and Cooperation Agreement included a provision allowing for the continued free flow of personal data to the UK from the EU, European Economic Area (EEA) and European Free Trade Association (EFTA) countries. This was effective 01 January 2021 and the UK, EEA and EFTA countries had to formally adopt an ‘adequacy agreement’ within six months. Such an agreement deems the UK’s data protection regime to be adequate enough to meet their own standards.
On 28 June 2021, a press release from the Department for Digital, Culture, Media & Sport announced that such an adequacy agreement had been reached. Secretary of State for Digital Oliver Dowden said:
After more than a year of constructive talks, it is right the European Union has formally recognised the UK’s high data protection standards. This will be welcome news to businesses, support continued cooperation between the UK and the EU and help law enforcement authorities keep people safe. We will now focus on unlocking the power of data to drive innovation and boost the economy while making sure we protect people’s safety and privacy.
The EU published a similar press release on the same date which says that the EU will be ‘closely monitoring’ the UK’s data protection regime. Indeed, the agreement contains a ‘sunset clause’ meaning that it expires after four years, at which time the UK’s data protection standards will be reviewed and the agreement may be renewed.
This is good and long-awaited news for businesses and payroll professionals who can carry on freely exchanging data. The adequacy agreement recognises that post-EU Exit, the UK’s data protection regime (the UK General Data Protection Regulation (GDPR), as contained in the Data Protection Act 2018) offers an equivalent level of protection to the EU’s GDPR. Though, we do have to be aware that the agreement will be monitored and adequate in 2021 needs to be adequate going forward.