The United Kingdom withdrew from the European Union on 31 January 2020. On 24 December 2020 the EU and the UK reached an agreement on their new partnership. It sets out the rules that apply between the EU and the UK as of 1 January 2021.
The agreement establishes a four month "Specified Period" (until 1 May 2021)- with an automatic extension of two further months if necessary, up until 30 June 2021 at the latest - during which transfers of personal data from the EU/EEA to the UK are allowed without any additional safeguards. This is called the Bridge period. The agreement states “the transmission of personal data from the Union to the UK shall not be considered as transfer to a third country under Union law", during this period.
However, the UK is subject to two main conditions during this period :
• the UK data protection law in force on 31 December 2020 must continue to apply and in particular such law as it is saved and incorporated into UK law by the European Union (Withdrawal) Act 2018 and as modified by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019; and
• the UK must not exercise its designated powers without consent of the new EU-UK Partnership Council. Designated powers refer to the ability to approve new transfer mechanisms such as standard data protection clauses, Codes of Conduct, etc.
The agreement does not address data transfers from the UK to the EU/EEA as that is a matter for UK legislation.
It is unclear how the situation will be after the Bridge period ends, as it depends on whether or not the European Commission will issue an Adequacy Decision.
Concerning the Memorandum of Understanding (MoU) between the UK Gambling Commission (UKGC) and the Netherlands Kansspelautoriteit (Ksa) this means the following:
1. in the event that the European Commission issues an adequacy decision before 1 May 2021 – or on 30 June if extended – personal data transfers between the UKGC and the Ksa will remain possible without additional measures.
2. In the event that the UK is not granted an adequacy decision by the end of the Bridge Period, the UK will find itself in a situation as if no deal had been reached in respect of data protection. The UK will become a third country in practice without being granted adequacy. The Ksa is obliged to follow the GDPR and its own laws concerning personal data transfers to third countries. Consequently, the Ksa will need to agree a “contract” with the UKGC about the protection of personal data.
In the event that such a “contract” cannot be concluded between the Ksa and the UKGC, personal data cannot be transfered between the two authorities. Cooperation based on the MoU between the Ksa and the UKGC will be no longer possible, and the MoU will not apply
Pending the provisions of any agrement reached, it is intended that the MoU re-apply once that agreement with regard to the protection of personal data has been concluded between the Ksa and the UKGC. Both the Ksa and the UKGC will make an effort to come to such an agreement quickly as required.
Signature Signature
René Jansen Sarah Gardner Kansspelautoriteit UK Gambling Commission
Date 30th April 2021 Date