Southern Utah

• Publication year: 2023
• Pages: 49
• Citation: Vol. 36 No. 1 Pg. 49

Southern Utah Vol. 36 No. 1 Pg. 49 Utah Bar Journal January, 2023

January, 2023

Southern Utah

Transferring UK Personal Data to the US using the UK International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses

by Rachel Naegeli

This article is an update to an article previously published in the Utah Bar Journal that my colleague, Robert Snyder, and I authored in 2021. Rachel Naegeli and Robert Snyder, Navigating Changes to European Union Data Privacy, 34 Utah B.J., 33, Nov/Dec 2021.

In "Navigating Changes to European Union Data Privacy," we explained how to use the European Union's updated Standard Contractual Clauses (New EU SCCs) to transfer "EU Personal Data," the personal data of individuals in the European Economic Area (EEA) - which includes the twenty-seven European Union (EU) countries plus Norway, Iceland, and Liechtenstein - to the United States. To quickly recap, an approved transfer mechanism like the Standard Contractual Clauses is necessary because the United States has been deemed not to have adequate privacy laws by the EU and the UK, among others. Thus, personal data transfers from those jurisdictions to the US are considered restricted transfers. Under the EU General Data Protection Regulation (2016/679) (GDPR), appropriate safeguards, including an approved transfer mechanism, are required in order for restricted transfers to be lawful.

The New EU SCCs were adopted by the European Commission in June 2021, providing one possible mechanism for EU Personal Data to be lawfully transferred to the US.^[1] At the time of our article's publication, one question that remained unanswered was how the United Kingdom would handle transfers of UK residents' personal data to the US in light of its exit from the European Union. Following Brexit, the UK adopted a piece of data privacy legislation almost identical to the EU GDPR. The UK version (the UK GDPR) contains an equivalent provision regarding restricted transfers in its Article 46, which also calls for appropriate safeguards for international transfers to countries that have not received an adequacy decision. Initially, the UK Information Commissioners Office (ICO) allowed transfers to continue on the basis of the "old" EU SCCs, which had been drafted to meet the requirements of the pre-GDPR EU Data Protection Directive, while the UK developed its own international data transfer mechanism. The big question was whether the UK would adopt standard contractual clauses that were nearly identical to the New EU SCCs or adopt something different.

In February 2022, the UK Government answered this question when Parliament was presented with a new UK International Data Transfer Agreement (IDTA), a stand-alone document equivalent but not identical to the New EU SCCs, and a data transfer addendum, an add-on to the New EU SCCs (the UK Addendum). The IDTA and the UK Addendum came into force on March 21, 2022. Organizations can now use the IDTA or the UK Addendum as a mechanism to comply with UK GDPR's requirement under Article 46, to take appropriate safeguards when making restricted transfers.

At...