Now that the United Kingdom is (finally) exiting the European Union (EU) one question U.S. based companies have is what happens to transfers of personal data from the United Kingdom (UK) to the United States under the EU’s General Data Protection Regulation (GDPR). The International Trade Administration’s (ITA) Privacy Shield Team recently put out guidance to address this question.
Good news is that Privacy Shield participants may rely on the EU-U.S. Privacy Shield Framework to receive personal data from the UK even though they are withdrawing from the EU. That is because EU law will continue to apply during the transition period from January 31, 2020 to December 31, 2020.
After the transition period–starting in 2021–a Privacy Shield organization must update its public commitment to comply with Privacy Shield to include the UK. Meaning, organizations must update their public facing privacy policy on their website to include certain language covering the UK. Model language is provided by the ITA (click here). And of course, in order to receive personal data from either the EU or the UK, an organization must be Privacy Shield certified.