Clifford Chance

Introduction

On 28 January 2022, the UK's international data transfer agreement (IDTA) was laid before the UK Parliament by the Department for Digital, Culture, Media and Sport, together with an addendum (UK Addendum) to the European Commission's Standard Contractual Clauses for international data transfers (EU SCCs) and a document setting out transitional provisions.   If no objections are raised by the UK Parliament, the IDTA and the UK Addendum will come into force on 21 March 2022.

What are the IDTA and the UK Addendum?

There are two alternative options for restricted transfers of personal data under UK data protection laws:

• IDTA: The IDTA is the UK's version of the EU SCCs – it is a contractual mechanism that organisations can use to regulate transfers of personal data that are restricted under the UK GDPR.   In particular, the IDTA provides an 'appropriate safeguard' under the UK GDPR where personal data is being sent or made accessible to a receiver that is located in a country outside of the UK which does not have an 'adequacy decision'.  For the time being, adequacy decisions for the purposes of the UK GDPR align with the European Commission's adequacy decisions.

• UK Addendum: The UK Addendum attaches to and incorporates the EU SCCs which were adopted by the European Commission in June 2021.  These EU SCCs, often referred to as the "new" EU SCCs, replace the three sets of standard contractual clauses that were adopted under the Data Protection Directive 95/46/EC (Old EU SCCs) such that, for data transfers that are restricted under the EU GDPR, the Old EU SCCs can no longer be used in contracts concluded on or after 27 September 2021.  Once in force, the UK Addendum can be used to incorporate and modify the (new) EU SCCs such that they can be used for data transfers that are restricted under the UK GDPR.

Organisations will be able to choose to use either the IDTA or the UK Addendum (incorporating and amending the new EU SCCs) when making restricted transfers under the UK GDPR, rather than using the Old EU SCCs.  This will address a disconnect that arose as a result of Brexit whereby the Old EU SCCs (and not the "new" EU SCCs) are currently an appropriate safeguard for restricted transfers under UK GDPR, despite no longer being available for new restricted transfers for the purposes of the EU GDPR – which created additional complexity for multinational companies whose data transfers where often subject to both EU GDPR and UK GDPR.  Many multinational companies are likely to choose the option of the UK Addendum for simplicity of contracting, given that their transfers may often be subject to both UK GDPR and EU GDPR.

As with the EU SCCs:

it will be key when using either the IDTA or the UK Addendum to populate them adequately with factual information regarding the relevant transfers – including details of the parties to the transfer, transfer description and purposes of processing; and use of either the IDTA or the UK Addendum will require the exporter conducting a transfer impact assessment, in line with requirements clarified by Schrems II (See our article "European Court of Justice renders new Schrems decision on international data transfers - EU-US Privacy Shield collapses").

From what date can the IDTA and UK Addendum be used?

If no objections are raised by the UK Parliament, the IDTA and the UK Addendum will come into force on 21 March 2022. However, it is unlikely that changes will be made to the versions of the IDTA and UK Addendum laid before Parliament.

The Information Commissioner Office (ICO) has stated that the IDTA and UK Addendum "are immediately of use to organisations transferring personal data outside of the UK, subject to the caveat that they come into force on 21 March 2022 and are awaiting Parliamentary approval".

Transitional arrangements

Under the transitional provisions, contracts concluded on or before 21 September 2022 on the basis of the Old EU SCCs can continue until 21 March 2024, provided that the processing operations remain unchanged.  However, contracts concluded after 21 September 2022 must make use of either the IDTA or UK Addendum for the purposes of any restricted transfers under the UK GDPR. 

Note that this date of 21 September 2022 is the corrected date – the transitional provisions document originally laid before Parliament contained an incorrect date of 21 September 2021.  At present the ICO has not indicated that the correction of this date has any impact on the date of entry into force of the IDTA and UK Addendum.

Changes made to the consultation drafts of the IDTA and UK Addendum

The ICO previously issued drafts of the IDTA and UK Addendum for consultation in August 2021 (see our previous article on this consultation "UK guidance on international data transfers – striving for pragmatism: Will it add clarity or complexity?", which includes a description of the IDTA and UK Addendum). 

The documents laid before Parliament differ to the consultation drafts. 

UK Addendum

As well as adding tables which can be used for insertion of signatures and factual information (such as details for population of the Annexes to the EU SCCs), the version of the IDTA laid before Parliament refines the mechanics for incorporation of the EU SCCs and their adaptation for UK data protection law, as well as adding provisions to address revision of the template UK Addendum by the ICO from time to time.  The UK Addendum retains a flexible approach, allowing the parties to agree alternative formats and provisions in some areas, provided certain requirements are met, as well now expressly setting out an option for including the mandatory clauses in a contract by reference rather than in full form. 

IDTA

The IDTA can still be used "as is" across different exporter/importer relationships (unlike the EU SCCs which have "modules" creating four different versions depending on the relationships involved). Helpfully, the IDTA can be used even if the data importer is directly subject to the UK GDPR (something which remains an area of confusion under the EU SCCs due to Recital 7, which suggests SCCs cannot be used for transfers to importers in third countries who are directly regulated by EU GDPR). Notable changes from the consultation draft of the IDTA include:

• Amendments and clarifications to the provisions relating to data breach, in particular to include a requirement for processor/sub-processor importers to notify exporter of all personal data breaches in relation to the transferred data (not only those which are likely to result in a risk to the rights and freedoms of data subjects).
• Importer Information and privacy notices – importers are no longer required to ensure that information they provide to exporters regarding relevant local laws and practices is 'complete', although they still need to ensure it is accurate and will have to take reasonable steps to verify whether there is additional relevant information regarding.  Exporters are still obliged to cooperate with passing on to data subjects the importer's identity, processing purposes and any further recipients of the transferred data, however this is now limited to circumstances where it is not reasonably practicable for the importer to do so.
• Updates to IDTA and termination – clauses have been added to allow parties to update the IDTA and provide for automatic update of the IDTA in the event the ICO publishes a revised version, along with related expansions to the termination provisions.
• Arbitration – it has been clarified that the option to refer a dispute to arbitration is applicable to a party or relevant data subjects only (reference to the ICO being able to do so is removed) and the concept of "IDTA Arbitration Scheme Rules" is removed and replaced by Rules of the LCIA.

What's next?

The ICO is expected to publish: (i) clause by clause guidance to the IDTA and UK Addendum; (ii) guidance on how to use the IDTA; (iii) guidance on transfer risk assessments; and (iv) responses to their consultation on the IDTA and UK Addendum.