Skip to content
Law Society of Scotland
Search
Find a Solicitor
Contact us
About us
Sign in
Search
Find a Solicitor
Contact us
About us
Sign in
  • For members

    • For members

    • CPD & Training

    • Membership and fees

    • Rules and guidance

    • Regulation and compliance

    • Journal

    • Business support

    • Career growth

    • Member benefits

    • Professional support

    • Lawscot Wellbeing

    • Lawscot Sustainability

  • News and events

    • News and events

    • Law Society news

    • Blogs & opinions

    • CPD & Training

    • Events

  • Qualifying and education

    • Qualifying and education

    • Qualifying as a Scottish solicitor

    • Career support and advice

    • Our work with schools

    • Lawscot Foundation

    • Funding your education

    • Social mobility

  • Research and policy

    • Research and policy

    • Research

    • Influencing the law and policy

    • Equality and diversity

    • Our international work

    • Legal Services Review

    • Meet the Policy team

  • For the public

    • For the public

    • What solicitors can do for you

    • Making a complaint

    • Client protection

    • Find a Solicitor

    • Frequently asked questions

    • Your Scottish solicitor

  • About us

    • About us

    • Contact us

    • Who we are

    • Our strategy, reports and plans

    • Help and advice

    • Our standards

    • Work with us

    • Our logo and branding

    • Equality and diversity

  1. Home
  2. For members
  3. Journal Archive
  4. Issues
  5. December 2020
  6. Brexit, Schrems II and international data transfers

Brexit, Schrems II and international data transfers

Organisations need to keep an eye on events until we see how data transfers abroad will be regulated after 31 December 2020
11th December 2020 | Laura Irvine

From 1 January 2021 the transition period has ended and the EU GDPR will no longer have direct effect in the UK. 

However:

  1. There will be a UK GDPR.
  2. UK data protection laws will remain the same, for the time being.
  3. International transfers of personal data will become more complicated.

Currently we can transfer personal data to and from organisations in EEA countries without any additional safeguards. Next year that will change and complicate international transfers of personal data, including the use of, for example, cloud storage where the server is hosted in the EEA. 

In addition, transferring data to countries outside EEA may be more complicated due to the Court of Justice decision in Schrems II (Case C-311/18). This invalidated the Privacy Shield, which allowed personal data to be transferred to and from the US without additional safeguards. It also impacted the use of standard contractual clauses (“SCCs”). 

These issues are still to be finally resolved, and so this article is intended to point you in the direction of what to look out for. 

Adequacy

The UK will become a third country under the EU GDPR and any data transfers from an EEA organisation to the UK will require additional safeguards in place, unless and until the UK is deemed “adequate” by the Commission. 

The Commission is considering whether the UK provides an essentially equivalent level of protection to data transferred here. We have had the GDPR for the past two and a half years, but there are concerns about several issues in the UK, including the bulk surveillance of communication data as highlighted in a recent case decided in the Court of Justice, Privacy International (Case C-623/17), which is the latest in a series of cases challenging the bulk collection of communications data by the intelligence services in the UK.   

There are also concerns that the UK Government intends to change data protection law, undermining data subject rights, as the Prime Minister stated earlier this year.

The UK Government has indicated that it will recognise adequacy decisions already in place, and it has also indicated that it will permit transfers to EEA countries to continue. The complication is ensuring that data can be transferred to the UK from these countries.    

A simple solution was thought to be through the use of SCCs, until the Court of Justice's decision in Schrems II. 

Standard contractual clauses 

Schrems II challenged the legality of the transfer of personal data to the US using SCCs. The court held that SCCs could still be used, but only with additional investigations to ensure an essentially equivalent level of protection in the third country. 

In October the European Data Protection Board (“EDPB”) outlined what it believes these additional investigations should be. Its recommendations are still in draft form. There are also draft recommendations setting out how to assess surveillance by public authorities in third countries. 

The Commission also took the opportunity to update SCCs. They now take into account the GDPR changes, and the new versions deal with transfers from EU processors to non-EU processors or controllers. Again they are still in draft. The current recommendation is to allow existing SCCs to be valid for another year. But it is likely that the EU will expect the additional investigations requirements to be satisfied sooner. 

The UK's position 

It is unclear what, if any, of these recommendations will be adopted by the UK. The ICO is considering the recommendations, but it will be up to the Department for Culture, Media & Sport (“DCMS”) to decide whether to implement the new provisions once they are approved. In particular, it remains to be seen how UK organisations will be expected to safeguard transfers to the US. If transfers of personal data are allowed from the UK to the US without the additional investigations, that will make the EU less likely to consider the UK adequate and will further complicate transfers from EEA organisations to the UK. 

Conclusion

The consultations in relation to these drafts end in December 2020, and organisations need to keep an eye on EDPB updates, Commission updates and ICO updates, but ultimately the UK Government/DCMS will determine the UK's approach to international transfers of data going forward and, like so many Brexit issues, that future is still very uncertain.

The Author

Laura Irvine is a partner with Davidson Chalmers Stewart

Share this article
Add To Favorites
https://lawware.co.uk/

Regulars

  • People on the move: December 2020
  • Reading for pleasure: December 2020
  • Book reviews: December 2020

Perspectives

  • Opinion: Emma Jardine
  • President's column: December 2020
  • Editorial: December 2020
  • Viewpoints: December 2020
  • Profile: Fiona Robb

Features

  • Homeworking: a journey
  • The Hague Convention: a 40-year evolution
  • Signed away? Privatisation and human rights
  • Intervening for equality

Briefings

  • Jury still out on verdicts
  • Corporate: My turn(over) or yours? Or theirs…
  • Intellectual property: Key role against climate change
  • Agriculture: A right less exercised
  • Sport: Widening the contract safety net
  • Property: Only "part of" the story
  • Property: Barony Register in new hands
  • In-house: Use your experience

In practice

  • Your Law Society of Scotland Council members
  • The Word of Gold: Works of friction
  • Risk: Conveyancing in the COVID era and beyond
  • The Eternal Optimist: Taking on the inner critic
  • Ask Ash: A friend in need

Online exclusive

  • Charities and the Equality Act
  • Online pricing: the CMA is watching
  • Insolvency: HMRC moves up the rankings
  • Brexit and family law: where are we now?
  • Brexit, Schrems II and international data transfers

In this issue

  • Now we are... 25!
  • Cybersecurity in a year of crisis
  • Can your client experience become a Toy Story?
  • Potential tax changes mean it’s time to talk succession
  • Is financial stress impacting your work?
  • Cloud technologies enable better client service

Recent Issues

Dec 2023
Nov 2023
Oct 2023
Sept 2023
Search the archive

Additional

Law Society of Scotland
Atria One, 144 Morrison Street
Edinburgh
EH3 8EX
If you’re looking for a solicitor, visit FindaSolicitor.scot
T: +44(0) 131 226 7411
E: lawscot@lawscot.org.uk
About us
  • Contact us
  • Who we are
  • Strategy reports plans
  • Help and advice
  • Our standards
  • Work with us
Useful links
  • Find a Solicitor
  • Sign in
  • CPD & Training
  • Rules and guidance
  • Website terms and conditions
Law Society of Scotland | © 2025
Made by Gecko Agency Limited